Add Phone Service Providers #2099

jonaharagon · 2023-03-22T15:34:47Z

Changes proposed in this PR:

Adds phone number provider page
Replaces duplicate images with symlinks

Closes: #2009

To-do list:

I have disclosed any relevant conflicts of interest in my post.
I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project.
I am the sole author of this work.
I agree to the Community Code of Conduct.

netlify · 2023-03-22T15:38:22Z

✅ Deploy Preview for privacyguides ready!

Name	Link
🔨 Latest commit	`0fbb534`
🔍 Latest deploy log	https://app.netlify.com/sites/privacyguides/deploys/641c7e2a105c2f0008668430
😎 Deploy Preview	https://deploy-preview-2099--privacyguides.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

docs/tools.md

dngray · 2023-03-23T02:42:06Z

One of the advantages of telnum.net is they take monero which I'm not aware of the others doing.

Their once-use disposable SMS numbers are useful for things like Discord. Some rooms there require a set phone number. Discord does do some checking to see if it's a VOIP number, and you don't get charged if no SMS is received from the VOIP number, so you can just try again.

jonaharagon · 2023-03-23T03:20:08Z

There is also https://silent.link/

ph00lt0 · 2023-03-23T09:37:45Z

There is also https://silent.link/

Silient Link however interresting is not VOIP but a regular esim. Would maybe fall in a data category with PGPP by invisv

ph00lt0 · 2023-03-23T09:40:38Z

One of the advantages of telnum.net is they take monero which I'm not aware of the others doing.

Their once-use disposable SMS numbers are useful for things like Discord. Some rooms there require a set phone number. Discord does do some checking to see if it's a VOIP number, and you don't get charged if no SMS is received from the VOIP number, so you can just try again.

I am not sure if we should recommend disposable numbers, it may link you to others which could be an issue if used for criminal activity and you therefore become a target. In addition we have seen that often numbers get tight to accounts for 2FA even if the users do not know this. So you will be locked out of your account. It is not always possible to see this consequence in advance.

ph00lt0 · 2023-03-23T09:42:11Z

Thanks for adding the criteria @jonaharagon!

i still think we need to warn users about the trackers in the Hushed app. And I really wonder why Google Voice is not on the list. For all I see this is the most stable option on Android if you live in the right area.

jonaharagon · 2023-03-23T13:03:20Z

@ph00lt0 see: https://github.com/privacyguides/privacyguides.org/pull/2099/files#diff-1e0a622877fe626bbe5eceee6525b85baed7d4eaf7addea856f4f04b6eaac7f1R77-R79

Google Voice doesn't meet at least two of our criteria. I'm not interested in recommending less privacy-respecting providers on a cost-basis alone, which seems to be the only advantage it has.

jonaharagon · 2023-03-23T14:10:05Z

After researching PGPP a bit more I think that the concerns about it I had in https://github.com/privacyguides/privacyguides.org/discussions/1615#discussioncomment-3355447 are correct, I'm not going to include them.

I did initially think that PGPP might still provide protection against third-party IMSI-catchers like Stingrays even though it doesn't protect against network operator tracking, but even in that case it appears that more advanced catchers can track IMEI numbers as well, which is the whole problem anyways.

ph00lt0 · 2023-03-23T15:16:23Z

After researching PGPP a bit more I think that the concerns about it I had in #1615 (comment) are correct, I'm not going to include them.

I did initially think that PGPP might still provide protection against third-party IMSI-catchers like Stingrays even though it doesn't protect against network operator tracking, but even in that case it appears that more advanced catchers can track IMEI numbers as well, which is the whole problem anyways.

To be clear, since the launch I have been very sceptical of PGPP and especially on their claims. But one thing they do well is that using cryptogaphy they made it impossible to figure out who pays for which subscription. This could still be a huge advantage that I have not seen elsewhere.

I was actually arguing a long time against PGPP' feature to automatically change IMSI numbers as tbh I think this only makes you more visisble. If I were some 3 letter agency I would be looking for IMEI number that regularly change IMSI.

jonaharagon · 2023-03-23T15:22:37Z

But one thing they do well is that using cryptogaphy they made it impossible to figure out who pays for which subscription. This could still be a huge advantage that I have not seen elsewhere.

I'm unsure how this is an advantage over paying for Silent Link with Monero?

ph00lt0 · 2023-03-23T15:24:52Z

But one thing they do well is that using cryptogaphy they made it impossible to figure out who pays for which subscription. This could still be a huge advantage that I have not seen elsewhere.

I'm unsure how this is an advantage over paying for Silent Link with Monero?

Because getting monero requires KYC giving vague companies pasport copies. Impossible to obtain in a sensible way. It surely isn't worse than paying with crypto.

jonaharagon · 2023-03-23T16:18:49Z

Okay, I'm following you. I added PGPP with the requisite warnings for review, it does seem like there is at least one compelling use-case. I also like that they have unlimited data.

ph00lt0 · 2023-03-31T18:28:08Z

https://ockham-solutions.fr/site/en/products/mercure/mercure-v4.html

Just for reference shows why IMSI changing is ineffective.

redoomed1 · 2024-06-05T04:23:20Z

docs/phone.md

+### Pretty Good Phone Privacy
+
+!!! danger
+
+    PGPP makes some claims about how their mobile network does not require trust in Invisv as a network provider, but they are not entirely accurate. Make sure you read this entry entirely before determining whether PGPP makes sense for you.
+
+This is our favorite cell service option if you want to pay with traditional payment methods, or need unlimited mobile data.
+
+!!! recommendation
+
+    **Pretty Good Phone Privacy** (**PGPP**) is a data-only eSIM service from Invisv, which can be paired with any recommended VoIP provider above for voice/SMS service.
+
+    [:octicons-home-16: Homepage](https://invisv.com/pgpp/){ .md-button .md-button--primary }
+    [:octicons-info-16:](https://www.usenix.org/system/files/sec21-schmitt.pdf){ .card-link title=Documentation}
+
+    ??? downloads
+
+        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.invisv.pgpp)
+        - [:simple-android: Android](https://invisv.com/articles/pgpp-updates.html#f-droid-and-apk)
+
+Invisv does collect your billing information through Stripe, their payment processor. However, PGPP's use of [blinded tokens](https://en.wikipedia.org/wiki/Blind_signature) for network authentication mean that Invisv cannot tie that billing information to your device. In other words, Invisv would be able to tell that "John Doe" has a PGPP account, but would not be able to determine which phone on their network belongs to "John Doe."
+
+Invisv additionally claims that your device cannot be tracked by the network because they periodically randomize your IMSI number, the identifier tied to your SIM card used to identify a subscriber. ==Unfortunately, this practice alone does **not** thwart device tracking.== Another identifier sent to networks is the IM**E**I number, the identifier tied to your phone hardware. You can think of an IMEI as your phone's "[MAC Address](os/linux-overview.md#mac-address-randomization)," except unlike with Wi-Fi/Ethernet MAC Addresses, randomizing or spoofing the IMEI is not possible and even illegal in certain countries.
+
+Therefore, unless you *also* physically swap your phone hardware every few days, ==it would be trivial for the network operator to build a location profile of a specific device despite IMSI randomization, because your IMEI is a static identifier visible to the network.== Additionally, PGPP will not even protect against anything but the most basic third-party [IMSI-catchers](https://en.wikipedia.org/wiki/IMSI-catcher), because most modern IMSI-catchers can track IMEI as well.
+
+This service requires an eSIM compatible Android phone, like the [Google Pixel](android.md#android-devices).


Invisv recently announced the shutdown of PGPP on their blog: https://invisv.com/articles/service_shutdown.html

Suggested change

### Pretty Good Phone Privacy

!!! danger

PGPP makes some claims about how their mobile network does not require trust in Invisv as a network provider, but they are not entirely accurate. Make sure you read this entry entirely before determining whether PGPP makes sense for you.

This is our favorite cell service option if you want to pay with traditional payment methods, or need unlimited mobile data.

!!! recommendation

**Pretty Good Phone Privacy** (**PGPP**) is a data-only eSIM service from Invisv, which can be paired with any recommended VoIP provider above for voice/SMS service.

[:octicons-home-16: Homepage](https://invisv.com/pgpp/){ .md-button .md-button--primary }

[:octicons-info-16:](https://www.usenix.org/system/files/sec21-schmitt.pdf){ .card-link title=Documentation}

??? downloads

- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.invisv.pgpp)

- [:simple-android: Android](https://invisv.com/articles/pgpp-updates.html#f-droid-and-apk)

Invisv does collect your billing information through Stripe, their payment processor. However, PGPP's use of [blinded tokens](https://en.wikipedia.org/wiki/Blind_signature) for network authentication mean that Invisv cannot tie that billing information to your device. In other words, Invisv would be able to tell that "John Doe" has a PGPP account, but would not be able to determine which phone on their network belongs to "John Doe."

Invisv additionally claims that your device cannot be tracked by the network because they periodically randomize your IMSI number, the identifier tied to your SIM card used to identify a subscriber. ==Unfortunately, this practice alone does **not** thwart device tracking.== Another identifier sent to networks is the IM**E**I number, the identifier tied to your phone hardware. You can think of an IMEI as your phone's "[MAC Address](os/linux-overview.md#mac-address-randomization)," except unlike with Wi-Fi/Ethernet MAC Addresses, randomizing or spoofing the IMEI is not possible and even illegal in certain countries.

Therefore, unless you *also* physically swap your phone hardware every few days, ==it would be trivial for the network operator to build a location profile of a specific device despite IMSI randomization, because your IMEI is a static identifier visible to the network.== Additionally, PGPP will not even protect against anything but the most basic third-party [IMSI-catchers](https://en.wikipedia.org/wiki/IMSI-catcher), because most modern IMSI-catchers can track IMEI as well.

This service requires an eSIM compatible Android phone, like the [Google Pixel](android.md#android-devices).

jonaharagon added the c:providers service providers and similar centralized/federated services label Mar 22, 2023

jonaharagon requested a review from dngray March 22, 2023 15:34

ph00lt0 reviewed Mar 22, 2023

View reviewed changes

docs/tools.md Outdated Show resolved Hide resolved

jonaharagon marked this pull request as draft March 22, 2023 16:57

jonaharagon added a commit that referenced this pull request Mar 22, 2023

VoIP Providers (#2099)

ea69981

jonaharagon force-pushed the jonaharagon/voip branch from c7d28bc to ea69981 Compare March 22, 2023 18:36

jonaharagon added a commit that referenced this pull request Mar 23, 2023

VoIP Providers (#2099)

2b3fadd

jonaharagon force-pushed the jonaharagon/voip branch from ea69981 to 2b3fadd Compare March 23, 2023 14:14

jonaharagon added a commit that referenced this pull request Mar 23, 2023

VoIP Providers (#2099)

d705c18

jonaharagon force-pushed the jonaharagon/voip branch from 2b3fadd to d705c18 Compare March 23, 2023 16:17

jonaharagon changed the title ~~VoIP Providers~~ Add Phone Service Providers Mar 23, 2023

jonaharagon added a commit that referenced this pull request Mar 23, 2023

Add Phone Service Providers (#2099)

94b708f

jonaharagon force-pushed the jonaharagon/voip branch from d705c18 to 94b708f Compare March 23, 2023 16:23

Add Phone Service Providers (#2099)

0fbb534

jonaharagon force-pushed the jonaharagon/voip branch from 94b708f to 0fbb534 Compare March 23, 2023 16:28

jonaharagon force-pushed the main branch 2 times, most recently from a45aaa2 to 4c805da Compare April 6, 2023 20:53

jonaharagon force-pushed the main branch 18 times, most recently from e124ecf to 82ab189 Compare March 31, 2024 09:04

jonaharagon force-pushed the main branch 10 times, most recently from 0a94f3f to d80af39 Compare April 11, 2024 17:36

jonaharagon self-assigned this May 22, 2024

redoomed1 reviewed Jun 5, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Phone Service Providers #2099

Add Phone Service Providers #2099

jonaharagon commented Mar 22, 2023 •

edited

netlify bot commented Mar 22, 2023 •

edited

dngray commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023 •

edited

ph00lt0 commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023 •

edited

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 31, 2023

redoomed1 Jun 5, 2024

Add Phone Service Providers #2099

Are you sure you want to change the base?

Add Phone Service Providers #2099

Conversation

jonaharagon commented Mar 22, 2023 • edited

netlify bot commented Mar 22, 2023 • edited

✅ Deploy Preview for privacyguides ready!

dngray commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023 • edited

ph00lt0 commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023 • edited

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 23, 2023

jonaharagon commented Mar 23, 2023

ph00lt0 commented Mar 31, 2023

redoomed1 Jun 5, 2024

Choose a reason for hiding this comment

jonaharagon commented Mar 22, 2023 •

edited

netlify bot commented Mar 22, 2023 •

edited

ph00lt0 commented Mar 23, 2023 •

edited

ph00lt0 commented Mar 23, 2023 •

edited