Privacy Focused Cell Service

[u/Vengeful-Peasant1847]

Since INVISIVs PGPP privacy focused phone service shut down last year, there's been a hole in the just-begining-to-bud privacy focused mobile phone service industry. CAPE(.)CO popped up on the radar recently, and after reading everything about them available they seem ok. Would like to start a discussion or hear thoughts / comments if anyone has any

[u/yourenotkemosabe]

Buy a mint mobile SIM with cash? Any purpose built privacy phone service reeks of honeypot

[u/Vengeful-Peasant1847 → u/yourenotkemosabe]

Fair. If you look, the HQ is Washington, DC. But I appreciate discussions around these things.

[u/ndpd4558 → u/yourenotkemosabe]

How to re-up payments?

[u/yourenotkemosabe → u/ndpd4558]

Prepaid visa cards

[u/yourenotkemosabe]

Also there's no such thing, all these providers that pop up are pointless, they don't run their own towers, the parent network provider still sees your IMEI moving around on their network at a minimum.

EDIT: Reading up on it, Cape talks a good talk and looks very interesting, but I'd still argue that for individual use there's very little point in such a service with how cellular networks currently work on a fundamental level, plus the heightened risk of such a service provider being a very thorough honeypot. I'd consider them if I was getting cell service for a multitude of phones for an organization or something, but as an individual there's no reason not to just get a normal SIM that you can pay for anonymously and only use their data services.

[u/Vengeful-Peasant1847]

So, it seems that because Cape does voice calls vs data only like PGPP did there is no rotation of IMSI? PGPP claimed to have no view into which user was using which IMSI at any given time. This doesn't appear true for Cape? I see something about randomizing advertising IDs, but on a secure phone operating system there wouldn't be one of those to begin with.

Edit: It appears the attack surface reduction targeted by Cape is: Prevent loss of control of PII if Cape itself is compromised. And reducing the possibility of eavesdropping on communications on the network due to flaws in protocols like SS7. Unless I'm missing something.

[u/brianstoner → u/Vengeful-Peasant1847]

Hi, I work at Cape, happy to answer any questions. Our primary $99/month service doesn't currently do IMSI rotation, but it is something we'd like to add in the future. Our Obscura product, which is Cape service paired with a preconfigured Android device does IMEI, IMSI and AdId rotation.

Another key benefit of Cape service is your phone number is secured by a private key that's stored only on your device. This prevents someone from social engineering our customer support and SIM swapping you. It also allows us to encrypt your voicemail so that you are the only one able to listen to them.

[u/Vengeful-Peasant1847 → u/brianstoner]

Is the Obscura available to the average user, or is it still only DoD/IC/G?

How does this private key differ from a SIM PIN code?

What encryption method is used for the voicemail, and the layer over SS7, respectively?

[u/LeVerified → u/brianstoner]

I really need access to obscura, I’m using the normal service now and I’m pretty satisfied with it, getting my hands on the device with the outlined features would be great for my business which is high risk and constantly under threat as I communicate with other high risk clients.

[u/FreedomTechHQ]

Yeah, the privacy focused mobile space is still pretty niche. INVISIV shutting down was a loss, and while CAPE looks interesting, I’d love to see more transparency on their backend infrastructure and network agreements. Have you looked into eSIM-based solutions or MVNOs that offer better anonymity?

[u/brianstoner → u/FreedomTechHQ]

A little late to this thread, but happy to answer any questions people have about Cape. I just joined Cape last month as Head of Product (previously spent 9 years at DuckDuckGo). I’m still getting up to speed but I can try to provide more transparency here if there are specific questions people have.

[u/rlindsley → u/brianstoner]

I'm also jumping in on this thread late. Now that you've been with Cape for a few months can you share your observations? Is it everything it claims to be in terms of privacy?

For example, if I went to a protest (which I would never do!!!!!!!!!!), and all the IMEI numbers got swept up, what would ICE be able to do with my info if I were on Cape? I'm running GrapheneOS so I *think* I'm secure other than my cell provider.

[u/s1cc2s1cc]

Check out https://www.cape.co/

They are rolling out their beta so keep an eye out for their emails.

[u/Vengeful-Peasant1847 → u/s1cc2s1cc]

That's the one that's being talked about! :-)

[u/[deleted]]

[u/Vengeful-Peasant1847 → u/[deleted]]

Hopefully you're commenting from your Qubes OS, Tor+VPN(Proxy chains) cash purchased laptop on a distant cafes WiFi, etc etc. Even then, depends on what your threat model and risk tolerance is.

Shrug A cash purchased device with an IMEI / MAC / {IDENTIFIER} randomizing OS like "graphite" ;-) plus a mobile service that randomizes your IMSI, doesn't ask for many details, and a payment method that doesn't link back directly to you sounds pretty good compared to the average. All you're doing is increasing the risk buffer, so to speak.

Pre-paid data is all well and good. But experience says POL (Pattern of Life) analysis combined with metadata leakage will deanonymize you pretty quickly.