Anonymous Tor Phone
0ut3r.space
0ut3r.space
- you unlocked your bootloader w/o re-locking it again → insecure
- you used a phone that doesn‘t receive OEM updates anymore → insecure
- you use firefox over tor: no sandbox, very unique fingerprint
- all of the device‘s traffic is routed over tor → any authentication on a non-privacy service compromises your anonymity
I don‘t think this is a good setup.
I tried Invizible Pro and do not see option for split tunnelling. I suppose Orbot may be a better choice if authentication to one of those services is needed.
In doing so, it also disables integrity checks, thus making persistence (even without rollback) a lot easier for a potential attacker.
So your phone becomes a lot more vulnerable to all kinds of attacks, not just physical ones.
See also: the Android Documentation for verified boot (https://source.android.com/docs/security/features/verifiedbo...)
Verified boot doesn't prevent you cleaning up the device. Modern android phones have wonderfully sophisticated per-file disk encryption.
In pixels, the decryption key is stored in a secure enclave (Titan M). If you want to wipe the device safely, you can just reset the OS. (This deletes the decryption key from the secure enclave which turns all user data on the user data partition into random junk).
GrapheneOS for example gets all of these things right. It is possible to make your phone secure, but not by permanently unlocking the bootloader and rooting the device.
Well yeah, welcome to the modern smartphone era. Those protections are useless or counter-productive because the base ROM has already spyware backed into it.
I don't know why some people consider a chinese no-name pre-installed rom more secured than lineage os but that's not how it works.
> In pixels, the decryption key is stored in a secure enclave (Titan M). If you want to wipe the device safely, you can just reset the OS. (This wipes the decryption key from the secure enclave which turns all user data on the user data partition into random junk.
None of that matters if your data is just sent to Google anyways.
If you assume this to be correct, then there's no point in attempting to make your phone private. Privacy isn't possible without security.
> None of that matters if your data is just sent to Google anyways.
when you use a custom ROM, that's not necessarily true. But using a custom ROM doesn't necessarily mean you have to permanently unlock your bootloader, so that argument doesn't make sense.
You have it the other way around, security starts with privacy at its absolute minimum. If data is sent to a third party every time you tap something on the phone, you are using an insecure phone, regardless of what complex hardware they are using.
> But using a custom ROM doesn't necessarily mean you have to permanently unlock your bootloader, so that argument doesn't make sense.
True, depends on the phone though, some of them cannot be locked again and there's no way to completely fix those phones with a better ROM.
> True, depends on the phone though, some of them cannot be locked again and there's no way to completely fix those phones with a better ROM.
Then you shouldn‘t use those phones for a secure setup. I think we can agree on that. But the author of the article used a phone that is capable of locking the bootloader with alternate ROMs.
Security requires privacy. A phone without privacy is insecure by design, insecure because it leaks data.
And the biggest danger to consumers nowadays isn't a bootrom exploit but that their location, card payments and data profile is sent to advertisers.
- Unlocking bootloader also makes the phone receive secure updates again.
- Firefox is a great browser that can resist fingerprints. The sandbox function on Android should be achieved by restrictions on permissions and storage isolations.
- Traffic over Tor is also much better than just over telecommunicator. A small fraction of non-privacy nodes is also not a problem as routes are always changed, and how can a organize contorl most nodes?
Additionally, the updates that the forked OS provides don't include firmware updates for essential parts like the modem (this is also the reason why phone updates are not available in the first place). So it's essentially a security theatre.
Firefox doesn't use per-site isolation, doesn't use process sandboxing and - on top of that has a JIT, so there's W^X violations. Normal app sandboxing via Android permissions is not sufficient for something as complex as a browser. The potential for possible exploits inherently is massive. Other browsers (chromium-based) like Vanadium have very sophisticated sandboxing, so there's no reason to use something inferior.
Traffic over tor is good, but shouldn't be used with authenticated services, as it deanonymizes your connection. Instead, it should only be used for specific (unauthenticated) actions, like browsing news.
how does it compromise anonymity if you sign in to a burner gmail account over tor?
Wouldn't this would depend on if you had a stream isolation setup? Pretty sure Tails/Tor Browser do this, so you can have a signed in Facebook tab and another tab open and the two won't be linked. I don't think the guide here accounts for that though.
I would be more selective with my traffic. Use Tor Browser for browser traffic, but keep sending Signal/Session/whatever through normal means. That makes your phone stand out less. Consider using a decent VPN like Mullvad, that should provide enough plausible deniability not to stand out.
Your only hope is either not using exit nodes (and only using hidden services), or encrypting all of your traffic _and_ making sure different apps/services use different Tor circuits. This does not happen by default, meaning all of your traffic is mixed together. It doesn't matter that it migrates routes every so often.
Exit nodes don't know where the traffic is coming from, until, of course, you accidentally access your personal domain name over HTTPS just by visiting it, which leaks through SNI. Hope you don't host your own services!
Tor exit nodes can only monitor traffic for a very short period of time, you create a new circuit and pick an entirely new path through the network very often.
>This does not happen by default, meaning all of your traffic is mixed together. It doesn't matter that it migrates routes every so often.
Absolutely true, a solution to this is to use Whonix or Tails which automatically stream isolates all pre-installed programs, therefore correlation by circuit sharing is impossible. Unfortunately that does not work on a phone, but in the end, using Tor for this is no worse than a VPN.
>Exit nodes don't know where the traffic is coming from, until, of course, you accidentally access your personal domain name over HTTPS
This seems like a straw man. There's not many options to Tor. A VPN will know where you're coming from by default.
It is every 10 minutes: https://support.torproject.org/about/change-paths/
> This seems like a straw man. There's not many options to Tor.
It wasn't intended to be a straw man, it was intended to highlight the complexity of hiding your identity online. Tor is indeed one of the best mixnets out there, but it is _not_ a panacea, and if used incorrectly can actually make your privacy _worse_.
The Tor Project itself has official guidelines on how to use Tor safely when you do need it: Tails or Tor Browser. Recommendations that stray from this, from an engineer not familiar with Tor, can actually be _harmful_.
Not only applications can leak all sort of data in cleartext, but your traffic is visible to exit nodes, and some are malicious.
Here is the list of issues I have with this blog.
1) LineageOS https://github.com/beerisgood/Smartphone_Security#custom-rom...
2) Riseup email, they have a mailing list, which apparently makes them unable to add a proper DMARC policy. As a result, anyone can spoof an email at any @riseup.net address, and the email would show up as a legitimate email on most recipient mail servers and they do not encrypt the data at rest per-user with the user's own keys like ProtonMail.
3) Session is great but lacks PFS (perfect forward secrecy)
4) bromite usually behind in updates which leaves it vulnerable to exploits
btw, On Android, Firefox is still less secure than Chromium-based alternatives: Mozilla's engine, GeckoView, has yet to support site isolation or enable isolatedProcess.
About Vanadium, it is mostly focused on security, and it takes advantage of OS hardening to do that. Brave is a fine choice, and it does offer fingerprinting protections that Vanadium doesn’t. It’s up to you which you’ll choose for you use case, but Vanadium takes the cake when it comes to a robust, secure and minimal browser
I would wager to say that, while possible to do, it is practically impossible for the average joe unless they own a Librem 5 which afaik is the only one with an open source antenna firmware.
https://source.puri.sm/Librem5/bm818-tools
But it seems it doesn't include the firmware, just some utils.
My CBRS test networks all have their cells configured to explicitly deny an emergency bearer request for life-safety purposes. As soon as they see the deny they keep moving on to the commercial networks.
- Rooting is definitely ill-advised but you note this
- I would not trust the security of most Android phones against phone unlock kits like Cellebrite
Android conspicuously doesn't include 'network access' as a permission, for what I can only assume is nefarious reasons. There's no reason my Calculator app needs to phone home anywhere.
The problem though really lies in the network. LTE is GPS trackable inherently. If you want to eliminate that problem, a Pager can work quite well if you are interested in receive only.
I refuse put the NSA in my threat model. If we get to that point as a business, we're going to have warrants blowing us up, secret fisa courts threatening our livelyhoods, and so forth.
However - there's no reason we should allow all advertisers to track us just because we are worried about the NSA
I know that some Android ROM's don't allow blocking all network access (only mobile data). But LineageOS, CalyxOS and GrapheneOS all allow blocking all/VPN/mobile network access.
It's nice to be able to sandbox an app so it can't do anything, especially call home.
I'm still hoping for an application firewall that will also let me use my real VPN, or hoping that my VPN provider will integrate this functionality directly so I don't have to choose between one or the other. I find trying to do everything over Tor quite limiting due to the number of web admins blocking it entirely. Even VPNs are starting to get frequently blocked, unfortunately.
For example, if you block facebook with a firewall, it can still send an intent to the download manager to make network connections.
(see https://madaidans-insecurities.github.io/android.html#firewa...)
Has tonnes of hardening though.
Also I feel like the Cloudflare problem and reCAPTCHA hell on Tor are stunting Tor adoption and I'm pretty sad about that. Higher speeds wouldn't necessarily solve those problems.
https://insightcrime.org/news/brief/canadian-company-custom-...
Glue that to a car, turn it on, and take off.
After a long enough time that the battery has died, ride your skateboard up to retrieve your anon filez.
And there's the whole cell baseband has root to your phone issue.
This feels like a lost cause, TBH if you use cell providers.
Now this could be useful with wifi calling and anonymous voip services. But using Tor is destined to leave you in the internet shitcan, primarily thanks to ilk like cloudflare.
> I resigned totally from using phone as phone itself, I have no physical number, or sim card, and I can only communicate securely using various channels like apps or emails.
Honestly, sometimes you should read the article.
The page doesn't want to load for me right now, but that may or may not be a problem depending on their threat model. If none of the things you're connecting to can see anything but a tor connection, and the cell network can see exactly where you are and who you are but not what you're talking to, how much of a problem is that?
> And there's the whole cell baseband has root to your phone issue.
So use one of the modems that just connects to the main processor over USB. I see this repeated a lot, but this particular problem is entirely solvable.
this and a whole lot more
it's amazing what some of the guys in my area will do for a bottle of whisky
I guess you SF-based techies are even more blessed than the rest of us
Traffic correlation: All the large state actors are well capable of recording every single IP transaction between devices. You can create detailed correlation maps from these transactions. Considering that this wouldn't cost much for state actors to implement, one has to assume such traffic correlation systems currently exists.
Node compromise: It costs less than 5 dollars a month to create a TOR node. There are currently ~8000 TOR nodes/relays in existence. That is 40k USD per month (at most). Do you really believe state actors can't afford 40k USD per month to compromise the vast majority of TOR nodes? Even a single millionaire can compromise the vast majority of TOR nodes.
Another problem is that TOR is an outdated privacy tech. considering modern state actor capabilities. Mixer networks + network jitter is necessary to protect privacy at this stage, yet no such project exists yet.
TOR is not a good option for privacy. Currently only valid option for privacy is external Wi-Fi jacking and ensuring you don't send any private info like CPUID.
Or alternatively, you can hack routers/computers and put your own TOR nodes in them, then you can only use these known nodes.
> TOR is not a good option for privacy. Currently only valid option for privacy is external Wi-Fi jacking and ensuring you don't send any private info like CPUID.
What is known for sure is that high profile drug dealers are using it without being caught for years. All known cases are related to either poor OPSEC, client/server 0-days, classic real-life investigations, or known attacks Tor can't protect from (correlation of the large amounts of onion server traffic, for example, which is not that easy as you make it sound). It is entirely possible that somebody was caught using unknown or unavoidable attacks, but no such case is known for sure at this time.
> Mixer networks + network jitter is necessary to protect privacy at this stage, yet no such project exists yet.
Tor does use packet shuffling and delays to protect from timing attacks to an extent. It's less advanced than I2P which also mixes the traffic, but has a much larger client pool and a unified browser used by nearly everyone, which provides users with huge buckets to blend into. There are also several delayed onion message services available.
Of course it is susceptible to certain kinds of attacks you have to be aware about. This isn't the same as "Tor doesn't provide anonymity" or "Tor is compromised".
It's Tor not TOR FYI.
https://support.torproject.org/about/why-is-it-called-tor/
> Note: even though it originally came from an acronym, Tor is not spelled "TOR". Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong.
We all know which one you fall under.
> Node compromise: It costs less than 5 dollars a month to create a TOR node. There are currently ~8000 TOR nodes/relays in existence. That is 40k USD per month (at most). Do you really believe state actors can't afford 40k USD per month to compromise the vast majority of TOR nodes? Even a single millionaire can compromise the vast majority of TOR nodes.
As someone who has ran a Tor exit node for 5+ years, lolol at this statement. Pure ignorance.
Does it cost less than 5 dollars a month to create a Tor node?
Is it?