[ art / civ / cult / cyb / diy / drg / feels / layer / lit / λ / q / r / sci / sec / tech / w / zzz ] archive provided by lainchan.jp

lainchan archive - /sec/ - 3815

File: 1485296831623.png (12.51 KB, 300x169, 12_amazing_tricks_you_didnt_know_tinfoil_could_do.jpg)


I want a tinfoil phone on a budget. I want a phone that runs linux and routes my calls from my cell phone # to it without calling it directly. I want it to be as secure as it can be for being a phone. It does not have to work perfectly as far as touch screen compatibility, as long as I am able to use it with a stylus, it is fine. It does not need to work with data, in fact I'd prefer that it didn't, as long as the wifi works fine. Which hardware should I use, which distro should I use, how would I go about this? Help appreciated, you guys are the friendliest people I could think of to ask.


> routes my calls from my cell phone # to it without calling it directly.
When you say to it, do you mean to say, you wannaa conn to a freeswitch instance of your choosing to make calls/sms over WiFi and prefer to not use the baseband at all?
For security, the best available ROM today is copperheadOS.
Only caveats is that only a small number of devices are supported.
For setting up https://copperhead.co/android/docs/



Basically, I want normal people to be able to call me through my normal phone # that I pay for through my regular phone service. For all intents and purposes it will seem like i am taking it through my normal phone, but really it is being routed to my tinfoil phone. All while the two devices seeming to be unconnected to anyone that would snoop into it. Is this possible?

I did not know about copperheadOS, thank you for that. Small number of devices is fine, as I will be buying a new device for this purpose.



Also, ideally, the phone calls would be untappable, people would not be able to eavesdrop on them. This is my goal.



The reason I would not want to just switch over to a different type of phone service rather than going through all of these complicated things, is that I do not want my real name etc associated with my tinfoil phone, and I would have to give the phone # out at some point obviously.


>want normal people to be able to call me through my normal phone # that I pay for through my regular phone service.
No SIP for you then.

>it will seem like i am taking it through my normal phone

Set up a VPN gateway on phone1, then connecting VPN client of phone2 on WiFi to said gateway and then initiate that Signal call.

>All while the two devices seeming to be unconnected

The point should be made here, that you don't gain any security in routing over phone1 seeing as the WLAN you're connected to can see the connection between the two devices.
All futures sessions with the same setup would create an obvious link overtime that phone2 is yours seeing as it only ever is in use when you want to tunnel through phone1 and correlating distance between the two devices from cell tower is child's play.

Realistically, if you just want to forward an additional number to your phone or forward from, you can do just that with SIP trunking, no need for phone2.



I see, alright. Would copperheadOS be the best option if I were to not take phone calls on phone2 and use the phone more like a palm pilot? This is more of a project of mine rather than a dire need that needs something really specific. I'm tired of being pressured everywhere to give up more and more privacy, through peer pressure, and through apps on the phone. I want to eliminate that pressure. Do you think getting a prepaid phone just for phone calls + using phone2 for everything else would be my best option?



Also, excuse my ignorance on this, I very much want to learn tech but beyond basic computer skills I am a newbie. However, I am eager to learn.


> untappable
Not a thing. Equivalent of bulletproof.
Rogue cell towers, they out here.
If a party can redirect your communications with less than 800 bucks, and the whole SS7 trash fire still remains I'd be lying to you if I said all your communications are unbreakable.

>I would have to give the phone # out at some point obviously.

Hence recommendation ^.
At least then you can rotate the # without having to do so with your hardware as IMEI and IMSIs aren't friends.


>copperheadOS be the best option
For security + android its the gold standard.
I'm unaware of any other ROM which comes even close.

>prepaid phone just for phone calls + using phone2 for everything else would be my best option?

You can get one, but that disconnection requirement you wanted won't happen as I explained.

>excuse my

No need for that lain. We all have to start out soemwhere


>Realistically, if you just want to forward an additional number to your phone or forward from, you can do just that with SIP trunking, no need for phone2.

Well, the reason I wanted the call forwarding is because I was under the impression this would create more security. But now I am learning that is pretty much impossible. So I have given up that aspect of my plan. I am trying to figure out my best option here.

I really don't care about people having my phone number and giving me a call, things like that. And if it really is impossible to secure your calls on a phone, then that isn't really a realistic goal. My main thing is that I just want something very secure that I can use while I am on the bus to look things up, read pdfs, fuarrrk with things, that is not going to pressure me to give up my privacy. I've started to feel like I'm constantly being tracked, and I hate that feeling. I would also like my calls to be as secure and anonymous as possible given the circumstances, while still using an actual physical phone, but it seems like my options are limited.


thank you for your patience and understanding.


To given extent it can, but it requires you signup for a free account with a SIP service provider and be placing your trust in that party, or go the extra miles and setup your own private branch exchange on your server.
After having gone through this process a dozen times now, I've learnt to appreciate that I now only have to worry about my colo provider.

>impossible to secure your calls on a phone

You can secure them to a certain extent.
The content of your conversations with something like Signal, Jitsi or any other VoIP client with SRTP and ZRTP supported would remain confidential, but the who was called, timestamp of call, duration, location call was placed, towers your call data passed through will remain known to your carrier.

>feel like I'm constantly being tracked

Sorry to hear tyou're experiencing that.
Can I ask, where did this come from?

...You mentioned being anonymous and wanting privacy.
If you want these plus security, carrying a phone reduces the chances of both the first two dramatically.
Doesn't mean go full on stallman.
You know you're threat model better than anyone else here, so just set some time aside to understand what it is you want.
Good entry point for getting to grips with this is reading https://grugq.github.io/, https://medium.com/@thegrugq.
Past case files, slip ups of others documented regularly https://cryptome.org, and for take down coverage in the markets http://deepdot35wvmeyd5.onion


File: 1485307106154.png (85.3 KB, 188x200, 1481473251300.jpg)

>feel like I'm constantly being tracked
>Sorry to hear tyou're experiencing that.
>Can I ask, where did this come from?

Not tracked like people are following me or keeping track of me on purpose or anything like that. Just, apps constantly asking where I am, constantly wanting me to back things up to their servers, automatically saving my things, saving my information, saving my search history, wanting me to connect everything to facebook which is basically people uploading data about themselves willingly, it's driving me a little nutty. I feel like I can never be secure on these types of devices and the whole smartphone culture people are in bully me if I want to be secure, if that makes sense. They bully you if you worry about your privacy. I don't know why. And the fact that my phone won't even give me control over my own system!! I feel like it's my phone so I should be able to do whatever I want with it, but it won't let me. That's not cool.

Thank you very much, I don't know how many lainons were in this thread but you guys gave me a lot of good information to start from and read up on. I won't be starting this project just yet but I will let you know how it goes once I've done some more research. I'm very excited about this, I didn't know where to start before this thread. You are the nicest tech people there are on the internet, I swear. Most other places would just be snooty.


I had a similar project in mind, finding an alternate phone option. I have a very rough idea of taking a Pi Zero, sticking it to a small screen, getting a cell module, and then installing an ARM version of Arch on it, tinker with it until I get some sort of usable interface for calling. It would very much satisfy my desire for more control over a device to make calls. Wouldn't cost you more than...$80 I'd imagine.



I've used phone like these. They are generally dumb phones that do have SIM card capabilities (GSM). However, simply running it on wifi and using a SIP provider.

Best bet is simply using (as >>3831 suggested) a rpi. But i'd go without the screen and just locking down the unit to allow for connectivity to your SIP provider and forwarding connections to a neutered cellphone with a SIP client on it. There are hundreds of permutations that'll allow for you to increase your privacy.


The solution to your problem of apps tracking you is flashing a basic custom ROM like whatever Cyanogenmod is called today or Paranoid Android, not installing Gapps, and just paying attention to what else you're installing after that. That will take care of all of your problems with software on your phone potentially sending data to advertisers. You'll still might have to deal with your cell service provide selling your location data to advertisers if you live in the US, but the only way to get around that is to just not use a cell phone or leave it off whenever you aren't using it.