[Tinkerphones] "We don't control our lives" - smartphones - tinkerphones - debian on smartphones

[Denver Gingerich]

On Fri, Jul 31, 2020 at 09:51:16AM +0200, rhn wrote:
> We seem to understand that "smartphone" is worrisome, and "laptop" is better. But each of those is made of a large number of technologies. What differences really matter? Let me pose a few questions that can hopefully help find the important aspects.

For simplicity, I'll start with a simple yes/no for each question, then expand on the nuances.  In most cases I'm referring just to tracking/surveillance and ignoring the issues with proprietariness of the software being run on the device still (and/or the "agency" that one has over the device itself).

Of course, all of these answers are my opinions.  I think it's a good list of questions, and helps a person figure out how they think about control issues, so even if others don't reply, I'd encourage them to think about what their answers would be.

> 1. Would a phone without a mobile modem be free of the control issues?

Yes.  You'd still want to be running all free software on that phone, but at least it won't be tracking you by default at all times.

> 2. Would a phone where the modem can't access RAM be free of the control issues?

No.  The cell carriers can still know your exact location whenever you have any sort of cell service.  It is better if you can turn off the modem entirely (as some phones permit).  I would only trust a particularly reputable company to do this, as many phones can have tracking/microphone enabled even while the phone appears off to the user:

  https://www.cnet.com/news/fbi-taps-cell-phone-mic-as-eavesdropping-tool/

> 3. Would a phone without Android?

Yes, if the modem has an off switch.  Android has all sorts of problems, the main one being that to most people "Android" mean "Android with the Google Play Store".  Even if you don't care about Play Store access, it is very difficult to get a phone based on Android (even Replicant) that doesn't have at least some of Google's spying anti-features enabled, since such Android projects need to actively search out all the anti-features (and will probably miss some), rather than building on something that has few/no anti-features to begin with (like Debian).

> 4. Would a phone without binary blobs?

N/A - the more important thing is the modem.  It is of course best to have no binary blobs, but they don't really have an impact on how much you are tracked, unless they're doing weird things like constantly broadcasting your MAC address (e.g. from a wifi chip), allowing you to be tracked.

> 5. Would a phone with a mobile modem but one that can't be carried outside of home?

No.  This seems bad because cell carriers can infer who you are by where you live, since the modem lets them see where you are at all times (and in this case shows you always at your home).

> 6. Would a phone with a mobile modem but using a SIP account?

Yes, if the modem has an off switch.  Being able to use a SIP account (and/or texting features via a service like https://jmp.chat/ ) is much better than using the cell network for your calls, since you don't need to reveal your location when you make the call or send/receive texts that way.

> 7. Would a laptop with a modem have the same issues?

Yes.

> 8. Would a laptop with un-emulated Android have the same issues?

Yes.

> All in all, both a phone and a laptop are computers, and I don't really see much difference between them, apart from size (and how close the modem is to CPU, although that's not universal). Using the words as a catch-all can be useful, but it obscures the actual important things that people care about.

Indeed.  The real problem is whether there is a cellular modem, and whether you can truly turn it off.

Due to the design of cellular radio technology, it is impossible to prevent the cell carriers from tracking your location whenever you are connected to their network.  And because there are only a few cell carriers in each country, it is easy for government or, in many cases, anyone with $300 to see where any person is at any time:

  https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-MicroBilt-zumigo-tmobile

You can make it more difficult for them to track you by using SIP or similar so that your phone number is not associated with your cell carrier.  But that doesn't prevent them from inferring who you are by where you go (and then using that to know exactly where you are at any point in the future after that).  I discuss a bunch of these trade-offs in this talk:

  https://livestream.com/internetsociety/radnets17/videos/164804778

In particular, one way of solving this is by creating a new radio network that is distributed, so that to get location info on any one person, you'd have to coerce hundreds or thousands of individual node operators into turning over that info.  I think this is a better way to do things than the cell networks, as it makes tracking much more difficult, and puts communication back in the hands of the people.  The above talk discusses some of the ideas for that, including using radio hardware that exists today in order to create such a network.

I'm happy to answer any questions or clarify anything about any of the above.  Thanks for the excellent discussions!

Denver
https://jmp.chat/