The protester's guide to smartphone security

I don’t understand under what logic AES encrypted radio communications (walkie-talkie) differ from AES encrypted radio communications (mobile network).

Well the whole point of hiding your tracks is evading law enforcement, why would you care if it’s illegal? Or is it because of the „only do one crime at a time“ thing?

How is it more secure than not having a phone?

If you‘re opening the cover, disconnecting antennas might be the way to go instead. Depending on the device, it‘s relatively painless and even reversible.

The idea is that they can’t tie the phone to a person. You also have to make sure you don’t get the burner phone some place with cameras.

Can you still buy phones with sim cards that don't require ID to get working? Not in Europe, UAE or Australia.

Just break your phone in two part after your call and you'll be safe /s

Lots of groups have used https://briarproject.org/ successfully in the past, I've heard. Assumes you're using Android though which if you're using a burner, you most likely are.

Here's a guide to PET (peer-to-peer, encrypted, through Tor) apps, focussing on Briar and Cwtch: https://itsgoingdown.org/the-guide-to-peer-to-peer-encryptio...

Depending upon which OS are on. If Android - Briar is the most famous and obvious choice. On iOS? There are not any options really but wasn't any usable one around a year back the last I had checked.

On iOS there are not many options for P2P w/o Internet (I assume that is what you meant - otherwise if you want P2P over Internet then there are some options although not really "truly" P2P of course - and of course if Internet is shut down or overwhelmed then it will be down). There's https://github.com/berty/berty (the last time I tried it was crashing incessantly but it might have improved). I do not know of anything else really (there might be few but I am not sure).

Hey that should go well with my tin foil hat.

Don’t both Apple and Android implement random BT MAC addresses specifically to prevent this kind of tracking?

Usually, protests are located in one somewhat easily defined area, until you cannot be there anymore or the goal has moved somewhere else. So then you need to get to another spot, this is the moment you disconnect your battery until you've arrived at the other place.

So yeah, they'd be able to say that "person A was at location B and later C", but not necessarily the way there or after/before those specific locations.

I agree that the safest is to assume they can definitely track you no matter what protocol/antenna you use, so you have to chose what moment it's OK to be tracked (like large groups).

Messaging doesn't have the same real-time requirements. It's still often flaky.

There are Meshtastic devices with keyboards that don't require a phone

There are a few devices floating around with a hardware switch built in. If you use a Pixel, grapheme OS is probably pretty trustworthy so you at least no there's nothing nefarious down to the OS level.

But yeah, in general if you take a phone just assume it's tracking you or at least making it possible for those with access to know you where there.

For the next few years it's fine. Functionally the feds just don't have the infrastructure to care about Meshtastic. In a decade maybe that'll change but two decades in the best they can do against drones is receive the ID DJI manufactured ones voluntarily broadcast and lookup the owner if they registered it correctly.

They're far dumber than most people give them credit, unless you off a rich guy they just don't have the resources to even think about penetrating anything but cell networks.

The encryption is pretty good, they're not likely to break it any time soon. The device MACs are whatever, unless you go to protests then go wandering around an urban area with the same radios for an extended period of time they're not going to do shit about it. They would have to geolocate from the RF emission and that's difficult to do to an accuracy necessary to uniquely identify you. Further, LoRa is still a bit of a pain to work with outside of using vendor chips which don't have non-cooperative DF capability so we're in the realm of expensive custom solutions from an RF shop which is far more money than the feds are willing to spend to dragnet a couple people.

1000 bits/s is still way faster than anyone can type a text message.

Four rules:

If you just want to talk to a few friends, don't bother with the default public mesh config, setup your own with encryption enabled.

Don't use longfast, use a higher speed setting if possible. Longfast will go 10km+ in optimal conditions and in a city environment, won't go any further than medfast.

Don't use the default radio channel, pick another one.

MAKE SURE ALL SYSTEMS ARE CONFIGURED IDENTICALLY - meshtastic is picky about all the radio settings being the same for bits to go through. It cannot figure out that the sender is using a faster/slower bitrate than you are so you will just get nothing. Do not attempt to use them until you've verified that all systems reliably send and receive messages in an uncontested environment. It's very easy to misconfigure meshtastic but once you do, fixing it in the field is going to be very difficult.

These are some pretty obscene claims to make with absolutely no proof or citation.

> What a lot of people don't realize is that a lot of the protests are organized by people who do not care if you get hurt, arrested, or die.

I mean, that’s kind of a given even for the protests that are legitimate. They really only happen when people reach a point of no return, and the organizers are more likely to be fanatics in the first place.

Reputable sources or stop spreading fud

Thankfully this attitude didn't set in during the civil rights movements of the 60s! Or we might still have had separate white and black bathrooms.

If we keep following such advice we may again have special water fountains and schools for those other people.

I am not a lawyer.

You just don't even want to be at the "proving intent" stage.

If you had a function/service that just automatically wiped your device at intervals, regardless of where you were and what you were doing, that might be more defensible than wiping manually.

Best is if your device can't be locked and doesn't have any evidence of anything at all.

There’s a setting on iPhone called “Erase Data” which will erase the data on it after 10 consecutive failed passcode attempts. That seems like a recommended setting for any smartphone to be honest, especially if it is used for business.

If you lost it and no police took it from you, wiping is the normal action.

IANAL, but I think the distinction is that "give us the password that unlocks this" is forcing you to testify against yourself, producing something from your own memory and forcing you to admit ownership/control of the object. (Which might not even be yours.)

In contrast, "the device opened in response to the same fingerprint/face that the suspect has" is a form of world-evidence which doesn't infringe on your mind, much like "the key found in your pocket unlocked the safe."

The reasoning behind this is that your fingerprints and face etc. are public knowledge. Whereas you can retain your right to remain silent (about your password/PIN), failing to provide these aspects of your person can be viewed as not cooperating.

How do you know what happened if you were blackout drunk?

It...depends.

If you're not technical, signal is hands down the best solution.

If you have a group that's going to something and you are willing to take some extra steps, something like matrix/briar/simplex/whatever setup with a self hosted instance provides you with the knowledge that all the infrastructure is under your control and that the feds just aren't going to have the time to sit down and figure out how this shit works.

The thing this thread is wildly missing the point on is unless you off a ceo or are a prolific organizer, the feds are systematic. They pick a set of techniques and technologies that cast the widest net possible with the money they have, then spend their time trying to nail people within that venn diagram. Yes, security through obscurity is not ideal in-and-of-itself, but combined with encryption and chaos, you can get much farther than using the same stuff everyone else has been using for a decade+. If you stay near the leading edge of tech the feds are a decade behind you, they still have years of threat briefing powerpoints to sit through before they can even think about implementing a countermeasure.

You could find 1000 CVEs in briar but if only a handful of of people at a demonstration are using it, the feds are still going to be sitting there beating their heads against signal because that's what they know how to do. If they ever find a single high severity CVE in signal, it's game over for everyone.

I meant at the server. We have no way to know that is running there.

I can definitely see this perspective. I'm a bit torn myself on the public event section. The second consideration is, yes they are filming, but just because someone is filming it's not necessarily a useful picture (blurry, low res, bad angle, obstructions, etc). Your picture might be useful especially since you may be closer to the action.

As another Portlander, disagree with exceptions: surveillance footage made it harder to identify people from top down angles, and it meant that a lot of people had their charges dismissed because of that. (I will need to look it up.) The bigger risk to a protest movement, I would argue, is an opposing agent provocateurs trying to get people doxxed. That risk to more people outweighs getting minority of provocateurs shut down.

(On the other hand, you’re also right that agent provocateurs are old COINTELPRO-era tactics used by the state and right wingers against protest movements.)

When it comes to tactics to keep yourself safe when protesting, there aren’t ultimately too many hard beliefs to be had, especially when the right are perfectly happy to collaborate with the state.

I mean there’s two sets of social norms here, right? Set one is that whenever you see the first person advocating or starting to break windows or start fires or do something else illegal, you all point at the guy and chant “fed, fed, fed” until he slinks away in shame or maybe shove him out of the crowd and into the police lines and let the cops handle him. The other set of norms is that when you see people do those things, you don’t snitch. Various protesters will adopt either set of norms.

Maybe you’d argue that the second set of protesters are actually feds; I won’t argue the point because I prefer the first set of norms myself.

This would be the same 'working class' that just re-elected Trump?