Any tips on how to avoid this? I suppose those tin foil signal blockers might be useful?
GrapheneOS isn't magically exempt from cell tracking, and both android and ios phones can go into airplane mode and have location disabled, which provides similar privacy.
>and an anonymous SIM paid for with cash or crypto. This should be done by everyone to avoid the possibility of mass surveillance, not only people who have something to hide from a three-letter agency.
No, it's much harder than just "an anonymous SIM paid for with cash or crypto". You need to practice proper opsec. There's no point getting an anonymous sim when you then turn around and then use it as a 2fa number for your bank, or carry it around with you every day.
You practically can't do anything on a Googled Android device or iOS without a Google or Apple account, so no, they don't provide "similar privacy." The point of a FOSS system is that the user fully controls it, and can install apps privately from any source.
If you're talking about not being able to install third party apps, aurora store doesn't require an account and works fine on stock android. Most other basic functionality works fine too, eg. camera, calls, browsing, maps.
The Play Store is not the only issue with stock Android devices. Google dependencies run with high privileges and the device is constantly communicating with Google servers for one reason or another. You do not own a Google device for all intents an purposes. The main contribution of Graphene here is that it strips out the proprietary blobs and optionally provides an environment to run Google's libraries with unprivileged access.
The point is you have to leave Google with both for it to do much good
Graphene offers the option of sandboxing Google apps should you want them. The usual setup is a second user profile with all the Google stuff in it. My main profile only contain FOSS apps and nothing passes through Google's servers. I use the Google profile for the maps with a dedicated account maybe once a month when driving somewhere unfamiliar.
> an anonymous SIM paid for with cash or crypto
i think these already have you screwed. that anonymity is going to be superficial at best. you will be recorded making these purchases, and tracked to your identity
This type of problem needs to be fixed on the society level.
I think that it is not a safe assumption that the only way corporations are obtaining people's location is via OS location APIs.
I don't think anyone who actually is at risk, or cares about risk, is going to be overconfident about their security because some HN commenter said "you're probably fine".
>What apps are "shady"?
Depends on your paranoia level. I'd say first party apps (eg. apple/google maps/weather) are probably fine. Google has the additional caveat that they record location history and therefore might be subject to geofence warrants. If you think iOS/Android is backdoored then all phones are off limits.
>How does the real-time bidding system obtain and divulge location data?
They're whatever ad SDKs can get their hands on. If the app has location permissions, it's that. Otherwise it's something like geoip. At the end of the day it's just third party code running in some app's sandbox. If the app can't get it, the SDK can't get it either.
>I think that it is not a safe assumption that the only way corporations are obtaining people's location is via OS location APIs.
What other plausible mechanism are there then? wifi/bluetooth scanning requires location permissions since forever ago.
Alternatively, broadcast a hidden SSID WiFi AP via an enabled RPi and use only devices that's have WiFi. Hand them out to people for free to increase the spread.
Attach magnets to the RPi's and go rogue by sticking them to buses, cars and trains et cetera to increase range.
Yes, 100%. Meshtastic and Meshcore both do this, but I'd recommend Meshcore. Here in the Seattle area we have a network that fairly reliably delivers messages from Canada through the Seattle metro area all the way down to Portland. Fully encrypted with dual key cryptography. Meshcore uses a different strategy than Meshtastic, which enables Meshcore to work more reliably. To see what's happening in your area for Meshcore see https://analyzer.letsmesh.net/map
Is very fun to set up a repeater for under $50 and see a noticeable difference in the coverage area. Is a fun technical project that combines the best of hiking/walking/driving geocaching style, ham radio (but without a license requirement), antenna building, and more. I'm getting acquainted with people in my neighborhood too which is a bonus.
Figuring out what hardware to buy that'll actually work can be a challenge, to get started search amazon for "heltec v3" and make sure you get something that includes a battery, and you'll see 2-packs of radios for $60. There's a web flasher at the above link that'll put the software on the radios for you.
ECB, issues with key generation, key negotiation, seldom authenticated data, ...
It definitely works better than MT but please stop lauding it for its cryptographic properties ;)
It's at the bottom of their TODO, under the heading "V2 protocol spec".
You learn something new everyday.
Don't do this!
The BSSID is still visible, and is the unique identifier any trackers will be looking for anyway. Also making the SSID hidden just means the AP isn't broadcasting it, any listeners can still see the SSID whenever any client interacts with the AP.