>I am also considering using SIP (VOIP) numbers for maximum privacy,
The problem is many services out there using SMS for authentication codes blacklist VOIP numbers and only accept real phone numbers tied to a SIM/eSIM. E.g. In USA, the Social Security website doesn't accept VOIP numbers to verify logins. Also, some software purchase validation schemes (i.e. using phones as a form of "DRM" restriction) reject VOIP numbers.
In the early 2000s when VOIP started being offered to consumers, nobody checked for "is it VOIP?" so didn't rejected them. It was as good as a real phone number. But that has changed and more and more places will not accept them. A lot of financial services (trading platforms and KYC reject VOIP numbers).
For a government website like Social Security, the fallback is for the citizen to go to the local office instead of authenticating credentials remotely at home. Same situation with the IRS tax refund website. The ID.ME identity website used by the IRS rejected VOIP numbers. If a person wants their tax refund released without giving up their phone # to ID.ME, they need to drive to the IRS office and verify their identity in-person.
For the software-verify-phone#-with-SMS, there was no other option. If one theoretically didn't have a real mobile phone #, there was no way to buy that software.
EDD in California doesn’t have any physical location for this, but that’s one of the smaller catastrophic failures of California’s current governance. This is despite giving away, with no accountability to tax payers) over 50 BILLION dollars to scammers and multinational organized crime during the pandemic.
I've always wanted to make a two-factor authentication device that has a camera, QR reader, and an e-ink screen for listing the codes that otherwise does nothing else. but ive always been a bit limited because I don't really know where to get started making hardware. but i feel like 2-factor authentication is the number one thing preventing me from getting rid of my smartphone which is kind of silly because why do i need some massive super computer in my pocket (at least from the perspective of the 1980s) to have an alternating cypher to login to websites on my laptop.
The easiest, fastest way to hack this together would be a raspberry pi zero with a display hat. It'd be chunky, but it would keep all the TOTP shared secrets off of other less reliable devices.
Some password managers like 1Password can do the two-factor stuff for you, so you don't have to pull out your phone. On the fully supported pages it'll just autofill your username, main password, and one-time password.
Just as a reminder. If you save the 2FA token in the same password database as the actual password of the website you effectively neutralized 2FA or at the very least weakened it.
If you store your password in a password manager, is it accurate to still frame it as 'something you know'? Or is it just another 'something you have'?
The headline is a bit misleading he got rid of ALL phones and says he will buy a Linux phone when available. Which makes no sense because there are Linux phones available and they still have the same problems he complains about in his initial paragraph. He still uses a sim but in a stationary devices. Which makes it likely he is most afraid of being tracked while on the go. I would have gone for a pure sip solution personally. If he uses a normal carrier or a sip product doesn't change anything but makes the setup easier. If he uses a burner sim it doesn't make sense to deploy it at home. Which also makes his IMEI/IMSI dancing obsolete. Could be a nice setup deployed in the wild but makes no sense at home. Lots of question marks tbh.
The simpler solution, I keep coming back to, get a "Faraday bag" and keep your phone in it. Pull the phone out only when you need it.
If you still want PhD levels of complexity then I suppose you can try to be very methodical about where/when you "unbag" your smart phone so as not to reveal too much information about your habits, locale.
There are several issues with the Faraday bag approach:
- Your (mainstream, commercial, surveillance-capitalism-AI-feeding moloch) smartphone remains a massive privacy / surveillance / manipulation threat.
- Odds are strong that you'll be leaving a strong location and travel signal by where and when you choose to unbag your device. Or bag it, if that occurs only near specific locations you intend to make private, effectively circling the area with a large, red "don't look here" sign.
- Your contacts list, contact history, activity, and data remain on what is primarily a surveillance tool to be used against you.
The approach taken here, in isolating the cellular network point-of-contact to a modem/router, which can reidentify itself (BSSID) and swap SIMs (this ... should be sufficient to break chain-of-event tracking, though you might find yourself burning through SIMs rather quickly), and relying on other, more-trusted devices for actual communications (voice, SMS (ugh!), Signal (much better), etc., is one I've been exploring for similar reasons. Suggested in a recent HN comment here: <https://news.ycombinator.com/item?id=45604692>.
Yes, it's more than a slight PITA, but such is the experience of swimming upstream.
I have read (without citations) that those measures are not enough. Off is not "off", Airplane Mode is at the discretion of the OS, pulling the SIM still leaves other radios on the device available, etc.
Personally I don't really care about tracking and I use it more as a power saving measure, but FWIW on my Librem 5 cutting the modem out of power is just a matter of a single flick of a switch on the side of the phone, making it trivial to use the modem only at will and keep the device WiFi-only otherwise.
Go buy a flip phone which has smartphone capabilities. You can use it for basic smartphone requirements (SMS, browser, camera, etc) but you really wouldn't /want/ to. This is the issue with smartphones - ease of use means you are constantly grabbing for it.
Having done this search before I can tell you there aren’t many great options. There is one (1) 5G flip phone, the TCL Flip 4 5G, but it runs KaiOS (not Android) and is carrier locked to T-Mobile.
Unihertz makes smartphones, not flip phones. Some have keyboards but they don’t flip open (no moving parts). They also don’t provide regular software updates and their phones are easily damaged. Honestly if you’re thinking about buying one of these smartphones, the iPhone SE line is probably a better choice. I’m still using my 2016 iPhone SE without issue, supports 4G LTE but no 5G and gets security patches from Apple. Can run most apps without issue. Newer SE models have 5G but ditched the home button, headphone jack, and got bigger, all downgrades imo. Another phone in this area is the Pixel 4a 5G, which I’ve considered buying to replace my ageing 2016 SE but haven't yet. (I might just replace it with another 2016 iPhone SE).
Japanese flip phones (Keitai) are there own separate rabbit hole which includes texting a random Japanese man on WhatsApp and paying him to unlock the phone for you.[0] Also very difficult (if not impossible) to find a 5G phone, most are running 4G or 3G. But they can run Andriod
The bottom line is that there are no great phones in this space. Dumbphones are a slightly different concept than flip phones; many people who use dumbphones also have a smartphone for everyday tasks (maps, banking app, etc.). These people are drawn to dumbphones for help with screen addiction, minimalism, or just the aesthetic, which is different for me because I'm looking for a flip phone that is just as capable and well-supported as the mainline smartphones but that actually fits in my hands and my pockets and has a long battery life.
>Why 5G?
Coverage and longevity. I've had my SE for nearly 10 years at this point and would like to be able to keep my next phone for just as long, even if 4G LTE becomes sparser/gets sunset. (I have already noticed that I get poorer coverage compared to 5G phones).
>Why Android?
I need to be able to run my banking app and all other this-could-have-been-a-website apps packaged for the masses.
For what purposes, may I ask? For privacy? For illegal stuff? For what? To be invisible you have to be ordinary. Ditching smartphone in this extreme way is completely opposite.
That doesn't work in the era of mass surveillance where you literally have to remain ordinary 100.00% percent of the time to remain invisible. That altogether defeats the purpose of wanting to be invisible.
I wonder how useful smartphones are without cellular service. Can you use GPS without it? Maybe meshtastic for local area communication. Are there alternatives to high speed Internet that’s not based on cellular service?
I currently have a phone with SIM card, and the old phone without.
Nothing but cellular service - calling, text, and phone-based internet - is affected. I could easily set it up to receive texts and phone calls when connected to my house Wifi, anyway.
The last gen iPods (that looked like an iPhone) were basically this. Also I've had friends who stopped paying for their cell service, same thing, just needed wifi.
Come on now, the author clearly not only has strong opinions about privacy but also enjoys messing around with weird hardware and AT commands and whatnot. That's not no reason, that's having a great time,.
The approach @sipofwater takes here, in isolating the cellular network point-of-contact to a modem/router, which can reidentify itself (BSSID) and swap SIMs (this ... should be sufficient to break chain-of-event tracking, though you might find yourself burning through SIMs rather quickly), and relying on other, more-trusted devices for actual communications (voice, SMS (ugh!), Signal (much better), etc., is one I've been exploring for similar reasons. Suggested in a recent HN comment here: <https://news.ycombinator.com/item?id=45604692>.
I'd suggest a few further elements to this approach:
- Carry a small-form-factor laptop or palmtop (there are DIY/hobbyist options available, though no commercial products currently) for any substantive communications. Keyboards still beat touchscreens for input by a wide margin, and are usually preferable to speech. The device can of course be provided with a mic and camera should you choose (I'd prefer external and removable here as well). Hybrid devices (laptop/tablet) provide the capabilities of a modern tablet (Android / iOS) with the keyboard stowed, but are a full Real Computer with it exposed, without the crippling limitations of either Google or Apple's mobile OSes and app stores.
- Find or make a mobile Bluetooth / WiFi only voice device. If you're looking for the ability to make and take calls when on the road, a small-form-factor device that doesn't talk to the mobile network directly could be pretty slick. (This would also be useful at fixed locations such as a home, office, or business as a wireless phone.) Apparently setting up your own pre-G4 hotspot violates broadcast regulations in most jurisdictions, so popping up your own dedicated Starfish to serve an old flip / candy-bar phone is an unlikely option.
Another major annoyance of any PSTN voice comms is ever-increasing rates of phone spam. Unfortunately, lowering comms costs to nil makes highly-marginal antisocial behaviours all the more viable. This is a reason I'm looking for VOIP options (small / home office) in which:
- Inbound calls would be routed to the VOIP system, which would deny, challenge, take a message, or forward calls to my mobile platform based on identity / characteristics. This would preserve ability of high-value contacts to reach me directly, whilst denying others claims to my time and attention. A sufficiently robust message / forward system, with, e.g., visual voice mail or voice-to-text transcription would also address the frequently cited exceptional cases of being able to accept urgent or emergency calls from, e.g., healthcare providers, schools, etc.
- Outbound calls would also be routed through the VOIP system. Even with an otherwise bog-standard smart- or feature-phone, this would reduce the surveillance footprint and value of that device in that it would simply be making and taking calls from a single number. Your contacts and comms device are entirely segregated, and the comms device itself becomes disposable without sacrificing a stable point of contact (now the VOIP system).
SMS texts and some related phone-number-based ID validation procedures would remain an issue with this system, though TFA looks as if it's addressing these in at least part.
I have a strong desire to achive control of my device, though I could care less about bieng tracked
at the network level.
One of my primary uses for my device is navigation, which I use OSM or derivitives for, and want to build an on device copy, that can be updated periodicaly.
given that there are phones with 1Tb internal, and have slots for 2Tb cards this should be doable with plenty of room left for media.
There are also species of ultra compact ssd drives availible now, and I look forward to having a nicely portable device, that has excess capacity for all but the most obsesive media collecting.
up next cameras, wich should be placed dead center and not project from the device back
bla bla bla
these guys say they are going to be shipping dev boards soon, looks tasty
>I am also considering using SIP (VOIP) numbers for maximum privacy,
The problem is many services out there using SMS for authentication codes blacklist VOIP numbers and only accept real phone numbers tied to a SIM/eSIM. E.g. In USA, the Social Security website doesn't accept VOIP numbers to verify logins. Also, some software purchase validation schemes (i.e. using phones as a form of "DRM" restriction) reject VOIP numbers.
In the early 2000s when VOIP started being offered to consumers, nobody checked for "is it VOIP?" so didn't rejected them. It was as good as a real phone number. But that has changed and more and more places will not accept them. A lot of financial services (trading platforms and KYC reject VOIP numbers).
Can't even create an apple account without a phone number (even though they sell devices without a (e)sim (slot) ).
Surely those systems have fallbacks for those lacking mobile service entirely?
For a government website like Social Security, the fallback is for the citizen to go to the local office instead of authenticating credentials remotely at home. Same situation with the IRS tax refund website. The ID.ME identity website used by the IRS rejected VOIP numbers. If a person wants their tax refund released without giving up their phone # to ID.ME, they need to drive to the IRS office and verify their identity in-person.
For the software-verify-phone#-with-SMS, there was no other option. If one theoretically didn't have a real mobile phone #, there was no way to buy that software.
EDD in California doesn’t have any physical location for this, but that’s one of the smaller catastrophic failures of California’s current governance. This is despite giving away, with no accountability to tax payers) over 50 BILLION dollars to scammers and multinational organized crime during the pandemic.
No, most don't. I've used that approach in the past for privacy and in recent years most services started blocking it with no alternatives.
I've always wanted to make a two-factor authentication device that has a camera, QR reader, and an e-ink screen for listing the codes that otherwise does nothing else. but ive always been a bit limited because I don't really know where to get started making hardware. but i feel like 2-factor authentication is the number one thing preventing me from getting rid of my smartphone which is kind of silly because why do i need some massive super computer in my pocket (at least from the perspective of the 1980s) to have an alternating cypher to login to websites on my laptop.
Years ago I had a little token that printed auth codes. They were everywhere. I had it on my keychain. I recall thinking it was nifty.
My Sensor Watch does this, I think it's one of its coolest features.
I still have one for getting into my bank
Well, to get started you could buy one of these:
https://www.reiner-sct.com/en/produkt/reiner-sct-authenticat...
… and then decide whether you really want to get into electronics development.
The easiest, fastest way to hack this together would be a raspberry pi zero with a display hat. It'd be chunky, but it would keep all the TOTP shared secrets off of other less reliable devices.
Airplane mode on a phone is pretty feasible and probably has more upsides than downsides.
Could probably compile it in if discipline is a concern.
(As I posted already in the comments here) put your phone in a "Faraday bag" and pull it out when you are expecting a 2FA authentication request.
That's precisely why I was interested in the Precursor: https://www.crowdsupply.com/sutajio-kosagi/precursor
I'll eventually pick one up to play around with..
Some password managers like 1Password can do the two-factor stuff for you, so you don't have to pull out your phone. On the fully supported pages it'll just autofill your username, main password, and one-time password.
Just as a reminder. If you save the 2FA token in the same password database as the actual password of the website you effectively neutralized 2FA or at the very least weakened it.
If you store your password in a password manager, is it accurate to still frame it as 'something you know'? Or is it just another 'something you have'?
Downside is such device is going to be obsolete soon with passkeys getting traction.
The headline is a bit misleading he got rid of ALL phones and says he will buy a Linux phone when available. Which makes no sense because there are Linux phones available and they still have the same problems he complains about in his initial paragraph. He still uses a sim but in a stationary devices. Which makes it likely he is most afraid of being tracked while on the go. I would have gone for a pure sip solution personally. If he uses a normal carrier or a sip product doesn't change anything but makes the setup easier. If he uses a burner sim it doesn't make sense to deploy it at home. Which also makes his IMEI/IMSI dancing obsolete. Could be a nice setup deployed in the wild but makes no sense at home. Lots of question marks tbh.
No kidding and it seems like he went to PhD levels of complexity in this exercise.
Agree.
The simpler solution, I keep coming back to, get a "Faraday bag" and keep your phone in it. Pull the phone out only when you need it.
If you still want PhD levels of complexity then I suppose you can try to be very methodical about where/when you "unbag" your smart phone so as not to reveal too much information about your habits, locale.
There are several issues with the Faraday bag approach:
- Your (mainstream, commercial, surveillance-capitalism-AI-feeding moloch) smartphone remains a massive privacy / surveillance / manipulation threat.
- Odds are strong that you'll be leaving a strong location and travel signal by where and when you choose to unbag your device. Or bag it, if that occurs only near specific locations you intend to make private, effectively circling the area with a large, red "don't look here" sign.
- Your contacts list, contact history, activity, and data remain on what is primarily a surveillance tool to be used against you.
The approach taken here, in isolating the cellular network point-of-contact to a modem/router, which can reidentify itself (BSSID) and swap SIMs (this ... should be sufficient to break chain-of-event tracking, though you might find yourself burning through SIMs rather quickly), and relying on other, more-trusted devices for actual communications (voice, SMS (ugh!), Signal (much better), etc., is one I've been exploring for similar reasons. Suggested in a recent HN comment here: <https://news.ycombinator.com/item?id=45604692>.
Yes, it's more than a slight PITA, but such is the experience of swimming upstream.
What's the faraday bag for? I mean, can't you just turn the phone off? Or even just put in on airplane mode?
I have read (without citations) that those measures are not enough. Off is not "off", Airplane Mode is at the discretion of the OS, pulling the SIM still leaves other radios on the device available, etc.
I've put an emf meter up to my phone in airplane mode and it doesn't emit anything at least.
Oh I need to try this! I just developed a super sensitive giga broadband detector. I am sure it will pick up something, thanks for the reminder!
Personally I don't really care about tracking and I use it more as a power saving measure, but FWIW on my Librem 5 cutting the modem out of power is just a matter of a single flick of a switch on the side of the phone, making it trivial to use the modem only at will and keep the device WiFi-only otherwise.
Go buy a flip phone which has smartphone capabilities. You can use it for basic smartphone requirements (SMS, browser, camera, etc) but you really wouldn't /want/ to. This is the issue with smartphones - ease of use means you are constantly grabbing for it.
Can you point folks to specific models?
Having done this search before I can tell you there aren’t many great options. There is one (1) 5G flip phone, the TCL Flip 4 5G, but it runs KaiOS (not Android) and is carrier locked to T-Mobile.
Unihertz makes smartphones, not flip phones. Some have keyboards but they don’t flip open (no moving parts). They also don’t provide regular software updates and their phones are easily damaged. Honestly if you’re thinking about buying one of these smartphones, the iPhone SE line is probably a better choice. I’m still using my 2016 iPhone SE without issue, supports 4G LTE but no 5G and gets security patches from Apple. Can run most apps without issue. Newer SE models have 5G but ditched the home button, headphone jack, and got bigger, all downgrades imo. Another phone in this area is the Pixel 4a 5G, which I’ve considered buying to replace my ageing 2016 SE but haven't yet. (I might just replace it with another 2016 iPhone SE).
Japanese flip phones (Keitai) are there own separate rabbit hole which includes texting a random Japanese man on WhatsApp and paying him to unlock the phone for you.[0] Also very difficult (if not impossible) to find a 5G phone, most are running 4G or 3G. But they can run Andriod
The bottom line is that there are no great phones in this space. Dumbphones are a slightly different concept than flip phones; many people who use dumbphones also have a smartphone for everyday tasks (maps, banking app, etc.). These people are drawn to dumbphones for help with screen addiction, minimalism, or just the aesthetic, which is different for me because I'm looking for a flip phone that is just as capable and well-supported as the mainline smartphones but that actually fits in my hands and my pockets and has a long battery life.
>Why 5G? Coverage and longevity. I've had my SE for nearly 10 years at this point and would like to be able to keep my next phone for just as long, even if 4G LTE becomes sparser/gets sunset. (I have already noticed that I get poorer coverage compared to 5G phones).
>Why Android? I need to be able to run my banking app and all other this-could-have-been-a-website apps packaged for the masses.
[0] https://old.reddit.com/r/dumbphones/comments/14qky1j/a_conso...
I've got a QinPhone candybar style phone, there are Japanese flip phones that work globally too.
I wasn't able to make the switch, I find that having a good camera on a phone is too much of a convenience.
Unihertz Jelly
Google for "tracfone flip fone"
For what purposes, may I ask? For privacy? For illegal stuff? For what? To be invisible you have to be ordinary. Ditching smartphone in this extreme way is completely opposite.
That doesn't work in the era of mass surveillance where you literally have to remain ordinary 100.00% percent of the time to remain invisible. That altogether defeats the purpose of wanting to be invisible.
"Ditching the phone? Addiction and Privacy": https://discuss.techlore.tech/t/ditching-the-phone-addiction... (discuss.techlore.tech/t/ditching-the-phone-addiction-and-privacy/15575)
I wonder how useful smartphones are without cellular service. Can you use GPS without it? Maybe meshtastic for local area communication. Are there alternatives to high speed Internet that’s not based on cellular service?
I currently have a phone with SIM card, and the old phone without.
Nothing but cellular service - calling, text, and phone-based internet - is affected. I could easily set it up to receive texts and phone calls when connected to my house Wifi, anyway.
The last gen iPods (that looked like an iPhone) were basically this. Also I've had friends who stopped paying for their cell service, same thing, just needed wifi.
Why wouldn't you be able to use GPS without cellular service? It would only make TTFF longer.
> I am also considering using SIP (VOIP) numbers for maximum privacy,
Ha. VoIP is de facto illegal. I tried to ditch phone numbers and tie a VoIP to email. Everyone blocks it. Banks, government, consumer websites…
That is not what "illegal" means.
There’s self hosting and DiY and then there’s making your life harder for no reason. I’m down for the former where it makes sense, but cmon now.
Come on now, the author clearly not only has strong opinions about privacy but also enjoys messing around with weird hardware and AT commands and whatnot. That's not no reason, that's having a great time,.
The approach @sipofwater takes here, in isolating the cellular network point-of-contact to a modem/router, which can reidentify itself (BSSID) and swap SIMs (this ... should be sufficient to break chain-of-event tracking, though you might find yourself burning through SIMs rather quickly), and relying on other, more-trusted devices for actual communications (voice, SMS (ugh!), Signal (much better), etc., is one I've been exploring for similar reasons. Suggested in a recent HN comment here: <https://news.ycombinator.com/item?id=45604692>.
I'd suggest a few further elements to this approach:
- Carry a small-form-factor laptop or palmtop (there are DIY/hobbyist options available, though no commercial products currently) for any substantive communications. Keyboards still beat touchscreens for input by a wide margin, and are usually preferable to speech. The device can of course be provided with a mic and camera should you choose (I'd prefer external and removable here as well). Hybrid devices (laptop/tablet) provide the capabilities of a modern tablet (Android / iOS) with the keyboard stowed, but are a full Real Computer with it exposed, without the crippling limitations of either Google or Apple's mobile OSes and app stores.
- Find or make a mobile Bluetooth / WiFi only voice device. If you're looking for the ability to make and take calls when on the road, a small-form-factor device that doesn't talk to the mobile network directly could be pretty slick. (This would also be useful at fixed locations such as a home, office, or business as a wireless phone.) Apparently setting up your own pre-G4 hotspot violates broadcast regulations in most jurisdictions, so popping up your own dedicated Starfish to serve an old flip / candy-bar phone is an unlikely option.
Another major annoyance of any PSTN voice comms is ever-increasing rates of phone spam. Unfortunately, lowering comms costs to nil makes highly-marginal antisocial behaviours all the more viable. This is a reason I'm looking for VOIP options (small / home office) in which:
- Inbound calls would be routed to the VOIP system, which would deny, challenge, take a message, or forward calls to my mobile platform based on identity / characteristics. This would preserve ability of high-value contacts to reach me directly, whilst denying others claims to my time and attention. A sufficiently robust message / forward system, with, e.g., visual voice mail or voice-to-text transcription would also address the frequently cited exceptional cases of being able to accept urgent or emergency calls from, e.g., healthcare providers, schools, etc.
- Outbound calls would also be routed through the VOIP system. Even with an otherwise bog-standard smart- or feature-phone, this would reduce the surveillance footprint and value of that device in that it would simply be making and taking calls from a single number. Your contacts and comms device are entirely segregated, and the comms device itself becomes disposable without sacrificing a stable point of contact (now the VOIP system).
SMS texts and some related phone-number-based ID validation procedures would remain an issue with this system, though TFA looks as if it's addressing these in at least part.
I have a strong desire to achive control of my device, though I could care less about bieng tracked at the network level. One of my primary uses for my device is navigation, which I use OSM or derivitives for, and want to build an on device copy, that can be updated periodicaly. given that there are phones with 1Tb internal, and have slots for 2Tb cards this should be doable with plenty of room left for media. There are also species of ultra compact ssd drives availible now, and I look forward to having a nicely portable device, that has excess capacity for all but the most obsesive media collecting. up next cameras, wich should be placed dead center and not project from the device back
bla bla bla
these guys say they are going to be shipping dev boards soon, looks tasty
https://liberux.net/