Jerry on PieFed

Just a techie guy running feddit.online to allow people to communicate, make friends and acquaintances. Odd coming from a happy introvert, right? (https://jerry.hear-me.blog/about)

I also own these publicly available applications:
Mastodon: https://hear-me.social
Alternative Mastodon UI: https://phanpy.hear-me.social
Peertube: https://my-sunshine.video
Friendica: https://my-place.social
Matrix: https://element.secure-channel.net
XMPP/Jabber: https://between-us.online
Bluesky PDS: https://blue-ocean.social (jerry.blue-ocean.social) Mobilizon (Facebook Events Alt): https://my-group.events
and more…

  • 14 Posts
  • 18 Comments
Joined 1 year ago
cake
Cake day: September 29th, 2024

help-circle


  • It’s worse than you think. An IMSI catcher is not even needed to find out what phones are in an area:

    Section 3.4.1: Presence Testing in LTE
    https://www.eff.org/wp/gotta-catch-em-all-understanding-how-imsi-catchers-exploit-cell-networks

    Passive Presence Testing

    The simplest way to do presence testing in LTE doesn’t actually require someone to have what we usually consider a CSS (e.g. a device that pretends to be a legitimate cell tower). Instead, all that’s required is simple radio equipment to scan the LTE frequencies, e.g. an antenna, an SDR (Software Defined Radio), and a laptop. Passive presence testing gets its name because the attacker doesn’t actually need to do anything other than scan for readily available signals (Shaik et al, 2017).

    RRC paging messages are usually addressed to a TMSI, but sometimes IMSI and IMEI are also used. By monitoring these unencrypted paging channels, anyone can record the IMSIs and TMSIs the network believes is in a given area . In the next section, we’ll see how an attacker can correlate a TMSI to a specific target phone, as right now collecting TMSIs simply means recording pseudonyms.

    There are descriptions in the article of other ways to find phones without using an IMSI Catcher or fake tower.






  • This tells me that you’d be in a lot of trouble if you lost your phone or had to wipe it because someone got into it. It’s probably good then that you’re now thinking about this so you can prepare for a time when you won’t have your phone for other reasons.

    All sites supporting 2FA usually allow you to use a second method. Email is usually an alternative. Assuming that your email is your universal second OTP method, you just need to make sure you will always have access to your email account and you’ll be fine. So just solve for the OTP problem for your email account.

    Pre-buy your burner phone and make it a second OTP device for your email account. For more assurance, buy a couple of physical keys (like Yubikey) that can be used with your email account. These can also be set up for some of your other accounts that support it, which may be more convenient than email when accessing them.





  • Yes, it’s worth it. I own mine for just the reason you give. You can take it to any other provider. And there’s no danger of the email provider deciding to close your account or cutting you off unexpectedly. Imagine losing your email access. At least with your own domain, you can switch it that same day to someone else.

    Unsure about whois lookup privacy. My registrar hides my details as an option. Anyone looking up the domain just sees them as the contact for the domain.