Hacker News Reader

Comment by sneak | Hacker News Reader

Been meaning to do this myself! Great to see it. :)

> While we would have to perform some more tests it appears that a full trusted boot chain (TF-A) is implemented from the early stage ROM bootloader all the way down to the Linux operating system.

This unfortunately means it will likely be somewhat difficult (or infeasible) to reflash it with a custom firmware that uses actual GPS location for targeting of satellites but reports a couple km offset to the telemetry service APIs to keep my residence address somewhat private from my ISP.

It's a bummer they didn't share the dumps. It always bothers me when researchers act all coy about their results. Now I have to get my hands on a dish myself and do what they didn't (namely, actually publish the data).

View on HN

By the way, sharing the dumps is probably a copyright risk.

Science in some countries enjoys copyright exemptions for doing research, but not for publishing raw data obtained from commercial sources.

Fair point, but anyone who knows how to dump firmwares knows how to publish files anonymously.

In doing so they put themselves in a precarious legal position. The author has given you all they legally are allowed to. If you want a copy of the firmware, you now have all of the information you need to obtain your own copy.

Do you normally have the ability to hide your address from your ISP? As the first owner of my house, I needed to have them physically come out to run a new line that didn't exist before, and there is obviously no way to have a cable run to your house without telling the cable provider where your house is.

My terrestrial ISP fails open on identity check/verification, so I was able to give them a brand new alias and answer "none of the above" to all of the public records verification questions, and simply run 100% of the traffic out of the pipe over a VPN via a VPN router. They see nothing but ciphertext to a datacenter. This did require their largest-tier service deposit due to null credit history, but such is life.

To answer your question directly, no, they have the service address. But with no other data to link the service address to me, this is okay.

With starlink I am hoping to upgrade the privacy setup to +/-2km location fuzziness. I don't think I'll ever use an ISP without 100% of the last mile traffic being VPN'd ever again.

How the heck did you manage to purchase the service anonymously? I had trouble even putting in service requests at first because my wife set up the account and didn't add me, so when I called, they wouldn't even talk to me because I couldn't prove I was the account owner. How do they bill you without knowing who you are?

Send me an email and I'll be happy to share specifics.

CenturyLink's DSL signup process pushes you towards the "simple credit check" option, but if you refuse enough times they let you sign up for prepaid and do absolutely zero validation of any of the information you supply.

You can also sign up for a "business prepaid" account and they won't even ask for your name. They also don't ask what type of entity the business is, so there's nothing wrong with just making up a Doing Business As off the top of your head.

Frankly, this is how it ought to be. My personal data are none of their business.

I doubt this will work too well with Starlink in particular. The satellite handoff has to be pretty precise. Even without GPS, the antenna (on one side or the other) can probably measure your location within a kilometer or two, and as the satellites improve (larger satellite-side phased arrays), that will shrink.

You have the ability to hide your traffic so the point is moot.

Gives IP geolocation a whole new meaning.

33-9207N-118-3278W.clients.starlink.com

How precise is that coordinate? My neighbor and I both have Starlink and our dishes can't be more than 200 feet apart.

Assuming that they're referring to decimal degree notation, and not Degrees-Minutes-Seconds, and that the location is correct, and ignoring the spheroid vs perfect sphere issues: about 11.1 meters (36.4 ft).

http://wiki.gis.com/wiki/index.php/Decimal_degrees

If it's DMS, again assuming location is correct, ignoring spheroid vs sphere: something between 80 and 100 ft (24.4 - 30.48 meters).

https://www.usgs.gov/faqs/how-much-distance-does-a-degree-mi...

Well, given the digit pairs include values greater than 60, I doubt it’s arcseconds/arcminutes.

Good catch. Curiosity got me and I focused on the distance aspect, missing the forest for the trees, so to speak.

'X' marks the spot!

If someone at starlink wanted your address I don't think lack of GPS would stop them.

What avenues would they have to determine precise location if the dish reported its location 1km off, the delivery of CPE went to a different name/address, the service is paid for with a prepaid card, and 100% of the traffic to/from the device is encrypted at L4 to prevent usefulness of sniffing?

Multilateration. Can’t cheat RF time of arrival/flight. And a StarLink terminal misreporting it’s position and the constellation indicating such an anomaly sounds like a paddlin’ from StarLink.

https://en.wikipedia.org/wiki/Multilateration

They know the locations of their satellites extremely precisely, and they know the round-trip time from them to the dish. It basically is a positioning system on it's own.

Sure, but to do this would require firmware support (due to the timing requirements) in the satellites themselves, I believe. I doubt that's happening right now.

As bitrates increase, time of flight becomes more and more of an important quantity. Also, it’s likely Starlink satellites will develop ability to do time of flight for military reasons, ie as a backup to GPS.

It's likely that is the real motivation for Starlink. Rural internet is just a bonus.

Laundering the money through FCC RDOF was a stroke of genius; I tip my hat to whoever came up with that idea.

That doesn't make any sense. There's WAY more money in commercial satellite internet than there is with niche US military contracts.

I don't understand why people are so committed to assuming there's a nefarious "real motivation" behind Starlink. Global telecomms is on the order of $2 trillion in revenue per year and growing. The US military's GPS budget is about $1.5 billion. So we're talking about addressable markets 3 orders of magnitude different in size.

Oh yeah, I'm sure this just for fun:

https://www.mentalfloss.com/article/75874/us-navy-returns-te...

The satellites are presumably themselves beamforming their transmissions to the dish to a high angular precision. If the satellites know their attitude precisely via star tracking and IMU, then a single satellite could be enough to geo-locate a dish.

I wouldn't be surprised if SpaceX tracks starlink satellite orbits via GPS, so that may limit their use as a redundant GPS system.

Now I'm curious what their command and control links look like. It's possible and perhaps likely that they can only communicate with any given satellite intermittently, as they fly overhead of ground stations.

Time of flight + beamforming data (which essentially generates an angle)

Have you actually ordered Starlink service yet? I'm on the list having put in a deposit and they expect to start offering service here in September. I had to give them an address so they know where to send the satellite to. That gives them precise location.

Though sure, you could make the purchase using a pre-paid card under a fake identity so they can't associate the address with a person. At least not through their own records. House deeds are public record, so if you own the house, they can figure out who you are by making a public records request, which is generally one way refi spammers find you.

Plus, depending on where you are, the government itself might sell your name and address to third parties. I know Texas does this, which is why I put getting a Texas ID for such a long time and continued using California ID until Texas last year decided you can't vote with an out-of-state ID. So now the DMV is selling my identity and I'm getting a lot more spam.

You can order the dish to a post box in your city. They currently work within a few dozen km of the service address.

> It's a bummer they didn't share the dumps

Agreed. Even if I had a dish (waitlist) the odds of me being able to disassemble and reassemble it with my electronics butterfingers is near 0. I would really love to pick apart the firmware though. I've done similar work on firmware disassembly to find ways into devices.

I was literally just thinking about the inevitability of someone doing this yesterday. I don't have the chops but there would seem to be a bunch of cool possibilities for the dish hardware for the SDR crowd.

I don't see how that would work if the satellite has to target the dish.

The beams that aim at the ground are substantially more than 1km wide at ground level, to the best of my knowledge.

It's the same concept as ubering to the house two houses down and across the street. Close enough for rock'n'roll.

It's also possible I'm totally wrong and this would break connectivity—but I doubt it.

Sure, the beam might be greater than 1km FWHM, but you’ll lose gain if you’re off too much, so they may be able to triangulate better than that just off of angle alone. It’s also possible they may do time of flight measurements (as a backup to GPS… which is relevant especially for the military side).

Reply on news.ycombinator.com