Hacker News Reader

Comment by barathr | Hacker News Reader

This is a layered problem; Apple and Google (for better and worse) are best positioned to deal with the app ecosystem.

But there's the mobile provider piece of this -- the tower knows where you are because currently it has to, and the network providers are part of this location data market, selling location data for everyone, whether they use leaky apps or not. This is worse with 5G due to smaller cells and thus finer-grained location data.

With a colleague I've founded a startup, Invisv, to provide location privacy -- and more. FWIW, Wired wrote up our work on this several weeks back: https://www.wired.com/story/pretty-good-phone-privacy-imsi-w...

View on HN

LTE will give you a datapoint roughly every 2 minutes. Accuracy will depend on the density of the LTE towers (150m - 2km). So besides Google, FB, etc. Telecom operators also play a role in this space. Remember that GPS might not always be turned on while your phone pinging cell phone towers happens all the time. With future 5G implementations this accuracy will be even further increased because the antenna range is short and the density will be much larger.

> fwiw, Wired wrote up our work on this several weeks back...

Link to research paper: https://www.usenix.org/system/files/sec21-schmitt.pdf

I would love to know if/when there's an MVNO with international roaming that implements PGPP. Any recommendations on the best sources or topics to follow to stay on top of this kind of news?

We plan to announce it at invisv.com and here; we will at some point set up a private beta mailing list as well.

Open source radios are the first step to privacy. We need to be able to choose the towers we connect to.

>We need to be able to choose the towers we connect to.

How does that help? If you do that the best you can do is obfuscate your location by a mile.

That’s pretty good

When Google does share location information with advertisers it is obfuscated to approx this range.

My personal understanding of this...... Show is that they never share my actual data but rather allow advertisers to target me based on these parameters, and if the advertiser is specific enough and get me to click I could potentially be identified by the ad.

Please prove me right.

For graphical ads, typically the advertiser can include beacons which can indicate membership in the targeted group, the same as a click. No interaction needed.

A trustless model in which the tower can provide a connection, know the relevant endpoint location on the tower hardware only, and prevent any access to that data except to law enforcement with a valid warrant. Providers don't need location data. Put in place lethal penalties for violating data privacy - if a company is caught harvesting data outside legal limits, they get fined into oblivion, and the money is split between victims and enforcement.

Being a service provider shouldn't mean an unlimited license to spy on your customers. Being a big corporation shouldn't mean you get to ignore the rules applied to individuals.

We need better laws, and we need to exclude megacorps and megamoney from the legislative process.

>A trustless model in which the tower can provide a connection, know the relevant endpoint location on the tower hardware only

but doesn't that mean you can still pinpoint people at the cell level? With cells being smaller in 5g networks, the problem is going to get worse.

Yes, so make it illegal for providers to send location data anywhere other than the tower hardware, and make it corporate suicide to collect the data, except at the individual level with a specific warrant.

> Make it illegal for providers to send location data anywhere other than the tower hardware.

The entire planet's mobile telephone system would then stop working.

As far back as GSM, your approximate location is continually updated in the HLR/HSS database (and VLR) so the the system knows where to send the MAP SS7 paging message to tell your phone to ring when someone calls you (or where to deliver a SMS).

Its a mobile network - it needs to know where you are.

I've had fleeting interests in this area for a while now, but for a number of reasons have never managed to do much in it.

The standards are all open right, for modern mobile networks. Every time I see this topic come up there seems to be something about patents and entrenched oligopolies (i.e with Qualcomm). Is there any legal or IP issues raised from making open source modems for LTE/4G/5G/whatever networks.

Hardware isn't the problem, spectrum licences are the issue

If you're really worried about this the only thing you can really do is not carry a phone, or carry one with a hardware radio switch and only turn it on when you want to use it. Of course you won't receive calls or messages, but that's not the end of the world, it's just like going back to the 1980s.

RFID blocking pocket is another option, or rotate prepaid cellphones every week or so. Neither is very convenient.

The _only_ possible solution to this problem is government regulation. An open source radio on your phone does literally nothing when the phone networks are all hostile.

Government regulation created your lack of options.

These are the people who have been giving literally trillions of dollars to the wealthy in their spending bills.

What would they have to do to convince you they are not going to help you?

It's always regulation to blame to some folks. If only we could have more 'free market' somehow companies would no longer spy on their customers.

I suggest you keep trying the same thing you've been trying to see if you can get some different results.

There’s regulation to protect human life, and then there’s regulation to protect business interests. The ”free market” advocates claim that the former are anti-competitive while they try their best to have the latter enacted.

You’re replying to a thread that disproves you.

It's possible for the state and big business to both be your enemy. In a country like the USA where big business owns the government that's often the case.

This is super cool. It's awesome to see someone trying to tackle this problem. I assume no carrier/mvno will adapt this but I'd be extremely happy to be wrong. I would instantly switch to a provider that made use of this tech.

Are the towers that precise? Can they tell if you are in Wallgreens or Home Depot?

Reply on news.ycombinator.com