Encrypting Phone Storage and Transmission? (2011 Version)

An anonymous reader writes "Soon I'll be moving to one of the hot, culturally restrictive countries which has recently been in the news ... and which monitors and filters web traffic. ISPs and cellular providers are both owned by the government. Needless to say, I'm concerned about privacy and am even posting to my fellow Slashdotters as an anonymous coward. Which smart phones are the best for a) encrypted storage, and b) encrypted transmission? I'm not worried about encrypting SMSs or traditional voice traffic, but I would like all IP traffic as secure as possible. Setting up a server in my less restrictive home country is an option. What storage encryption and transmission encryption would you recommend for that situation? I'm willing to buy yet another device, if necessary. (No, I won't get a SatPhone.) I currently have a Nokia N900 running Maemo5 and another device running Symbian S60v3. I was hoping to have a secure OS like BackTrack running on the N900, but it looks like the software was never totally ported for the device."

Comments

Traditional VPN?

[RyuuzakiTetsuya]

Why not a traditional VPN with an Android or iOS device? Symbian should also be able to support VPN connections as well.

Re:Traditional VPN?

[b0bby]

That's my thought too. There are lots of reasonably priced VPN services out there, or you could run your own. But for ~$10 a month or less, why bother? I've used the $6 "Premium" service from hideipvpn.com & it was fine, I'm sure that there are others that are just as good though.

Re:Traditional VPN?

[morcego]

I have OpenVPN running nicely on my Android 2.1 phone. Had to root it, tho.

And since you are rooting it, you shoud be able to partiton you sdcard and setup some kind of encrypted filesystem. I havent tried it yet, but might just to see if is possible.

Also, in a country like that, you might try getting a phone without a camera... just in case.

Re:Traditional VPN?

[MoonBuggy]

I thought the same, but there are a few important supplementary questions (to which I don't know the answers):

• By consistently streaming encrypted information out of the country, will you just make yourself a target for more invasive surveillance measures (and perhaps some rubber hose cryptanalysis)?
• When the ISP themselves are your adversary, you're at an immediate security disadvantage. How far can they go towards cracking your connection when they can monitor everything you transmit, and cross reference it with real-world info about you?
• If your connection is compromised, how much extra risk are you at? Is the sense of security leading you to transmit things that you wouldn't otherwise have committed to writing, and might they cause you trouble?
• Are these encryption measures legal where you're going? Even if so, are the state the type who might see it as a reason throw you in jail on vague espionage charges?

I understand wanting to maintain your privacy as a matter of principal, but ultimately you're the one choosing to go to their country. You don't have to like it, but you do have to live by their rules. From my own experience travelling in some of the more repressive parts of the world, I would say that there's generally a certain amount of leeway given to foreigners that isn't afforded to locals, but you're still safer not giving them an excuse to pay you any extra attention. What I can't tell you (especially without knowing which country you're going to) is what they will or will not consider to be an excuse; honestly I doubt that even a police chief in the country could give you a definitive answer in a lot of places - the strictness of the definition tends to be inversely proportional to the wealth and influence wielded by the person that it is being applied to.

Just bear in mind that while it may be discomforting to know they're reading your emails home, they probably don't care what you're saying. They might well start caring about the fact that they can't see what you're saying.

Re:Traditional VPN?

[Anonymous Coward]

You'll probably either have to recompile the kernel, or compile and install the encryption & fs modules. Fitting on 1GB ROM means sacrificing kernel options desktop distros do not.

...but at least it's possible with enough effort, if you're a geek. Which is what I like most about Android.

Though it's not like 90% of /. userbase would or could do it on their own without a step-by-step tutorial.

Re:Traditional VPN?

[gandhi_2]

Could a constant stream of encrypted data going thru his carrier and ISP bring government attention to him or her?

Will this hot, culturally restrictive government just throw their hands up and say, "well... he's got a VPN... not much we can do"?

Re:Traditional VPN?

[lakeland]

Right, most phones can be set to send all IP traffic over the VPN. That'll mean someone has to break your VPN to get at the traffic which is hard enough you may as well consider it impossible. Also, it has the advantage of being very easy to set up.

Re:Traditional VPN?

[Anonymous Coward]

If you are going to Iran, I can tell you that OpenVPN does NOT work in any way. I've tried UDP, TCP, random ports, even static keys (to avoid TLS detection). I've looked at the traffic with tcpdump and it seemed they could detect it's OpenVPN after the connection was established (don't really recall the details) and simply drop the connection and block the destination IP:port for a while afterwards. SSH, PPTP and Tor were working back then. I wouldn't rely on it though. Also, expect very bad connections to outside (sometimes incredibly bad). Occasionally the connection was good enough to use Skype over OpenVPN over SSH :D.

If you are going to KSA, you might be in luck: OpenVPN, SSH, Tor worked. Might still be working, though with the recent developments in the area they might have started to filter more aggressively.

In any case, I recommend avoiding the use of cryptography too much because it will almost certainly turn on some alarms. And in some places cryptography might actually be against the law. I wish you good luck!

Re:Traditional VPN?

[postbigbang]

Using a VPN doesn't automatically finger you. Keyword filters-- the spoken kind of keywords-- do. If you do data, reboot frequently to change your IP address. Or, if you think about it, change your MAC and IP address by incrementing by 1 or 2 (etc) your address; you're unlikely to bump into a collision. Smart guys figure out address domains.

Otherwise, figure you're being listened to all the time. GSM is as easy to crack as an egg these days. Data ought to be encrypted as mentioned above. Don't save files with names like 'terroristplantonukethebigdam'. Be sane. Be a bit extra paranoid. Have fun.

Re:Traditional VPN?

[LifesABeach]

phones can be jammed, electricity can be turned off. Given the 5th world pide of Islam's Leaders, use Semaphore, in some tested cases, it's better than AT&T's service.

Re:Traditional VPN?

[Anonymous Coward]

Different A/C from op...

But...do you use the same android I use? Off the shelf, and even on my jailbroken G2. Android doesn't support full device encryption. Maybe venders have a model out there that does...

Even the remote wipe on the ones that claim to support exchange... is...a lie.

A freaking blackberry or iphone is more secure out of the box!

Let's see... no options to remotely wipe it without third party apps. No ability to have any sort of 'wipe' behavior happen on bad password input. There are 'wiper' apps--so I can send my phone a text message and have it zero itself out. That's slightly better than nothing at all.

No ability to encrypt all local storage requiring a password to make the previous option *actually* useful. So any remotely competent forensics team can power the thing down or throw it into a foiled bag, take it out inside and remotely image it. Probably over USB by default, although I haven't tried it.

No, instead they have a crappy app store where I can purchase an app that will send encrypted SMS messages to encrypted people, and store it in an encrypted file separate from my regular messages.

But the fucking thing still saves my google password for anybody who cares to enter a pin along with a bunch of email.

And VPN...I bet out of the box the damned VPN password is unencrypted. If it doesn't use a password, it probably caches the password to the certificate forever. Just great..now anyone who gets their hands on it can impersonate me.

Look, Android is convenient...but if I ran a company and set the security policy, they'd be added to a document as a firing offense to use in their current state.

Re:Traditional VPN?

[Unequivocal]

All good points. To add a concern: I don't know the laws in these countries, but perhaps even possessing crypto tools is illegal? I'd check into that before using this stuff in country.

Re:Traditional VPN?

[Kakari]

Although if you can get the people you really want to talk to elsewhere on board, you could use RedPhone. Not what the question is asking, but another way to help.

Re:Traditional VPN?

[cayenne8]

I think the best advice would be...to stay as far the fuck away from any middle eastern country to begin with!!

That's just asking for trouble....unless you happen to be someone that wears some form of the various headgear/hats the peoples over there seem to all sport.

Why any sane person from the free part of the world would go over there....especially NOW...is beyond me.

I mean, hell...I'd do just about anything for a dollar..but I'd not risk my life (and head) by going over there for any amount of money.

Re:Traditional VPN?

[jrumney]

Exactly. My advice to someone going to a country like this is to make damn sure you stay under the radar. Be prepared to give up your daily porn habit, your torrenting, and your urge to give your opinion on every political topic under the sun. If this is too much for you, then don't go to countries with oppressive regimes.

Re:Traditional VPN?

[kangpeh]

Ok, I'm going to give you my complete and honest suggestion. I haven't really posted even a comment on slashdot in years, but I felt that I should provide my in-depth knowledge on this topic. I am an Android enthusiast and have been well versed in other smart phone backends including the Maemo (which is an amazing device. Great choice!)

To begin, on iOS, Android and Maemo you can access a PPTP VPN with no additional effort.

Additionally, on Android and Maemo you can also connect to an OpenVPN based VPN gateway in the event you need stronger encryption. It is often recommended by security experts to avoid encryption such as those implemented within the PPTP protocol like MPPE (mschapv32). On the other hand, however, OpenVPN uses SSL based security which is very much praised throughout the technical company as being secure.

However, on both Android and Maemo there will be some setup time which will have to take place to get OpenVPN working. On the Maemo, it is as simple as installing the OpenVPN application. On Android, however, you will need to ensure that your phone is rooted and that your kernel either has built in TUN support or you may compile your own custom kernel from sources.

If your security is of utmost importance, then go ahead and take the steps to setup OpenVPN on your device. However, if you are just worried about your privacy and nobody is trying to break your encryptions, then PPTP may be enough for your purpose. Personally, I use PPTP when OpenVPN is unavailable.

Now, I would strongly recommend using a provider such as Private Internet Access ( URL: https://www.privateinternetaccess.com/ ) for a VPN service provider since they do in fact offer both PPTP and OpenVPN and also have gateways in both the US and Sweden. Another option would be to setup your own VPN gateway on one of your servers. Personally, I opted for a managed VPN account to avoid the headache. ;)

Hope this helps you timothy!

Re:Traditional VPN?

[AmiMoJo]

TOR is also available for Android. Unfortunately full encryption of the phone's flash storage won't be available until Gingerbread 3.0 though.

Re:Traditional VPN?

[Anonymous Coward]

> I think the best advice would be...to stay as far the fuck away from any middle eastern country to begin with!!

US Administration...are you listening?

Re:Traditional VPN?

[TA]

OpenVPN runs fine on the N900 too (I use it a lot), and as the author has the N900 already he should be all set up.

Re:Traditional VPN?

[jonbryce]

Email is probably going to be an ssl connection to an exchange server back home, so even if you do nothing, they can't read your emails. A lot of people are going to use VPN to access their workplace network back home simply because it is the only way to get in, so I don't think VPN traffic will be that unusual.

Re:Traditional VPN?

[orasio]

I think the best advice would be...to stay as far the fuck away from any middle eastern country to begin with!!

There is a western, christian country, that is in the news at all times, known for seizing laptops at borders and keeping your data.
In fact, when I travel there, I don't carry my laptop or any personal/work data with me, that's how worried I am.

Why any sane person from the free part of the world would go over there....especially NOW...is beyond me.

There is no free part of the world. There are only shades of grey. There are places where you are safer and worse places, but enemies of freedom exist and act everywhere.
Add to that the fact that your definition of freedom probably doesn't match what some other people believe, and the whole "free world" concept becomes a dumb idea.

I mean, hell...I'd do just about anything for a dollar..but I'd not risk my life (and head) by going over there for any amount of money.

And you probably make enough. The world is full of people who risk their lives to make a dime. Otherwise, there would be no cops, no antenna installers, no tall buildings. That is because they can make a better living that way than staying safe.

Re:Traditional VPN?

[gl4ss]

it depends a bit on which symbian s60 3rd ed phone he has, not all of them shipped with the vpn bits(3rd party software though could help with that, though I don't know if any of the solutions that work are sold for consumers).

anyways, go with a shabby symbian that you can get the needed sw for, that way you're off the radar at checkpoints. if you bring satphones or stuff that looks like it, you'll get flagged. that's how it works if they've been following the news too.

oh and a FAKE encrypted drive there never hurt, if you're asked to open the file vault in interrogation.

Re:Traditional VPN?

[Anonymous Coward]

SSL traffic can be intercepted by any national telecom authority whose root certificate is installed on the client device. This includes OpenVPN traffic to commercial providers who are using a signed SSL certificate.

Re:Traditional VPN?

[GameboyRMH]

Yep and it's possible to encrypt most of the storage on the N900 as well, although it's a gigantic PITA. I'd set aside a good bit of time just for getting that working. The downsides: Increased CPU usage (just overclock to compensate), the root partition can't be encrypted (not a huge problem, just don't store anything sensitive on it), and once you encrypt your 32GB internal storage and MicroSD, you can't access them via USB mass storage mode. You can still use anything else though - you can use SCP or Samba instead, you'll just have to wait a while if you plan on sending multi-GB files over wifi.

Other great stuff: Remote tracking/control/wipe via SMScon and sshd, ability to run a Tor client and Asterisk right on the device, ability to run TrueCrypt right on the device, ability to mount an encrypted container instead of a whole partition to allow USB mass storage to work.

Re:Traditional VPN?

[gtvr]

Nice post. One thing that might be good about setting up your own VPN gateway - if I was an oppressive regime, I would block access to any of the known proxy servers/anonymizers etc.

Re:Traditional VPN?

[RockDoctor]

Are these encryption measures legal where you're going? Even if so, are the state the type who might see it as a reason throw you in jail on vague espionage charges?

Not just encryption measures. I was travelling to a not-very-hot, not-particularly-repressive country to work one time and I was planning to take my hand-held GPS, just for shits'n'giggles. But I had the burglars come round and take it instead, so I didn't. When I was there, I discovered that a nearby town had recently completed the conviction and sentencing of an American in the area for possession of a GPS. He got (reportedly) 5 years @ hard labour, though no one had any doubt that he'd have been quietly thrown out of the country after a few months, once the fuss had died down. Note that he wasn't charged with espionage or anything sinister like that (that's a 9mm trepanning, on sight, no trial), it was simply possession of this dangerous technology in that region of that country. An offence of strict commission. No extenuating circumstances could possibly exist.

I was glad that I didn't have a GPS to take with me.

I understand wanting to maintain your privacy as a matter of principal, but ultimately you're the one choosing to go to their country.

Shock horror! Foreigners could possibly have the right to make their own rules for their own area? What sort of heretical un-American activity are you involved in. McCarthy would be spinning in his grave if he could hear you talk (unless you're not an American, at which point McCarthy would learn to say "Meh!").

Re:Traditional VPN?

[elrous0]

By consistently streaming encrypted information out of the country, will you just make yourself a target for more invasive surveillance measures (and perhaps some rubber hose cryptanalysis)?

Obligatory xkcd.

Re:Traditional VPN?

[phoenix321]

Which "not-particularly-repressive country" convicts any Western citizen to 5 years of forced labor camps for possession of a GPS device? And how's that "not particularly repressive"?

Please tell me so I can avoid that hellhole. All phones now have GPS embedded which I can't possibly turn off when crossing the border. And I won't buy a second phone just for a 10 days vacation. I will gladly rewards laws like that by saving them from having to take my dirty Western tourist money.

Re:Traditional VPN?

[morcego]

I wonder if we can get FUSE working on Android. That would open a lot of possibilities...

Re:Traditional VPN?

[LifesABeach]

Actually, America is NOT a free country, it IS a liberated country. In America, everything has a price. And after a certain Supreme Court decision by some judges, two of which that should have shut their mouths, I'm sorry, "abstained" from a certain decision on the definition of what people are, our price tag for things American became cheaper. That's what I'd call "living large" in America. XD

Re:Traditional VPN?

[vikarti]

I think I know this country (becouse I'm remember about almost same(or it was same?) incident, but in one I remember it was slightly different: - GPS device was professional-class one and was _needed_ for this person to do work he officially comes to (installing new model CDMA base station needs it. - he was near military installation - there was outrage even _inside_ said country(and it was only one issue with it). - GPS devices are sold(and were sold before) in this country a lot.

Re:First post...

[grei9715]

Ah, but was your first post made securely?

Watch out

[Anonymous Coward]

If you are going to Saudi...co-workers couldn't wait to get the hell out of there. VERY SCARY PLACE. Public beheadings on Fridays.

Re:Watch out

[Anonymous Coward]

But the Saudi's are an American ally? How could they be a brutal, repressive dictatorship that exports terror to the world if they're an American ally?

I heard from Glenn Beck that Kenyan Muslim Communists like Obama want to overthrow our allies in the middle east to spread the Muslim Caliphate across the world. Are you a Kenyan Muslim Communist?

Re:Watch out

[Anonymous Coward]

"Are you a Kenyan Muslim Communist?"

Is that you, Mel?

Re:Watch out

[cerberusss]

If you are going to Saudi...co-workers couldn't wait to get the hell out of there. VERY SCARY PLACE. Public beheadings on Fridays.

If you're going to point to public beheadings as scary, maybe you'd like to think about the difference between public beheadings and the following:

"[...] the gusto with which the State of Texas enforces the death penalty (during his six years as Governor, G.W. Bush signed a death warrant once a fortnight on average)" -- Richard Dawkins.

Start all your conversations with ....

[Anonymous Coward]

Start all your conversations with "Death to America! Long live the revolution!" And if you're in a Muslim country, tack on "Allah be with us all!" They won't even bother to listen to the rest of your conversation.

Your welcome! No problem!

Re:Start all your conversations with ....

[Anonymous Coward]

Great plan. Instead of an old fashion castration for watching online porn, you've earned yourself a lifetime sentece in Gitmo complete with daily torture.

Re:Start all your conversations with ....

[cheater512]

Or alternatively if the oppressive country is the US, just start it with "God bless America!"

Re:Start all your conversations with ....

[Anonymous Coward]

haha blessed with what? i can't wait to get the hell out of here.

Re:Start all your conversations with ....

[gtvr]

Since the US is not oppressive, your comment (or attempt at humor) makes no sense.

Note that just because a country has some laws, or limits, doesn't make it oppressive. In America you don't have to worry about how to get around government filters to express your opinion, in case you hadn't noticed.

Re:Start all your conversations with ....

[cheater512]

No, but there are those pesky illegal wiretaps.

Buy the phone in that country

[ogfomk]

You will just need to buy that phone in the country you are going in. Otherwise you may loose it through customs unless you are a diplomat. Best to get something boring and assume that everything you send is readable by anyone. If you keep something that is valuable there is nothing that customs would like better than to have your device.

Re:Buy the phone in that country

[Anonymous Coward]

Customs might have a screwdriver you can borrow to tighten it.

Re:Buy the phone in that country

[Anonymous Coward]

Ttis is absolutely wrong. You are entitled to your personal phone in every single country I have visited. That includes all in the GCC and the ones ending in stan. All of them. I do not know about north Korea or Myanmar but int Middle East tris is a non issue. Even in ksa you can carry a mobile with camera (i would advise you against it btw)

About the use of VPN, it is most likely illegal in these jurisdictions. Everybody will tell you they are using one without problems. Both statements are true. Legality as someone pointd is seldom binary, less of all in these places. that also means that The Guy in front of you May or May not know the most current regulations. It actually does not matter as he is, by definition, right. Someone was rguing for two hours with a Kuwaiti custom officer that february does not have 31 days.

Unless you cross a local you will be fine, if they want to screw you, honestly, they do not need much. Not so different from the US/UK nowadays from what I read. Most countries have plenty of unenforced laws that can be used to screw you when required. Foreigners are always more vulnerable.

Oh I almost forgot, where I live the isp has the ability to implement a man in the middle attack as they can sign certificates, they also have the ability to do deep packet inspection. Now you know where I live.

Re:Buy the phone in that country

[Anonymous Coward]

I tried to reply to this but it does not show. I do not know what your experience in this region is ogfomk, but this is an untrue advise (do you work for Axom maybe and sales are low?)
This ist totally untrue if we are talking about MENA/GCC or any other country ending in "stan" I should know as I live in this region and travel extensively.
the only restriction used to be the use of mobile phones with camera in KSA, but even that is now lifted (unless you happen to be a teenage female high-schooler)

Use of VPNs is mostly forbidden, at the same time almost everybody is using them. By using any encryption you are putting yourself at risk (specially in iran) but they may decide to enforce or not, depending on how interested they are on screwing you. BTW where I live the reference ISP can sign certificates, it was discussed in slashdot some time ago. And they have access to deep packet inspection. All of this gleefully sold by freedom-loving west companies. Thank you very much.

On the ground, laws are not so important. The guy in front of you may not even know or care about them.

BTW this is not so different from UK/US, just ask any of the people who get into troubles for taking pictures videos or whatever in cities. Have they broken any law? no. Can LE try to make their life miserable? Yes, and they can be successful.

Re:Buy the phone in that country

[Anonymous Coward]

Best advice in this thread

Re:Buy the phone in that country

[Anonymous Coward]

Well, it is my third attempt to comment on this so called advice.
This is simply untrue in the GCC/MENASA/stans. Only place where this was true was North Korea AFAIK, where you were supposed to rent. Not anumore, I mean you can not even rent.
http://www.telecompaper.com/news/north-korea-stops-handset-rentals-for-foreigners

Why are my posts being removed to protect a piece of unreliable advice? I have no clue.

A little different

[BigJClark]

This isn't the exact solution, but you sould be able to tunnel a skype connection over the Tor network, for a short period of time.

Depends on the length of communication, which isn't stating in the question.

Re:A little different

[Lehk228]

but if you are carrying around a fiber optic line to handle that, why not just use it directly?

boncee

[Lord Ender]

Bouncee is a VPN service designed to protect the privacy of international travelers. It encrypts all your network traffic and routes it through a server in the United States.

It's also really, really cheap. This sounds like what he's looking for.

Re:boncee

[icebike]

Bouncee is a VPN service designed to protect the privacy of international travelers. It encrypts all your network traffic and routes it through a server in the United States.

It's also really, really cheap. This sounds like what he's looking for.

Do they have a mobile version?

Re:boncee

[Lord Ender]

Right now PC is supported, but mobile support is planned.

Re:boncee

[zonky]

I'm not sure why everyone always trusts the other ends of these cheap vpn services so readily. If you wanted to set up a credential fishing operations - why wouldn't you just set one of these up and watch the exit gateway?

Re:boncee

[Lord Ender]

If you wanted credentials you would host a free service. A commercial service would have far fewer users and a money trail to the person who runs it.

mobile VPN

[Anonymous Coward]

I think to an android device with OpenVPN on it. It provides you with a very good encrypted VPN. Look on http://openvpn.net

A couple of things.

[natehoy]

(1) As far as encrypting the data on the phone itself, I'd recommend Blackberry if you can swing it. It's the only phone I know of that has the capability of actually encrypting the filesystem, though maybe that's changed.

(2) Having said that, any data you send/receive is going to go through Blackberry's servers and your privacy/protection depends on whether RIM is playing ball with that country or not, in addition to any snooping the local cellco might be doing. So you'd better make sure you are accessing things over SSL, or you might consider an VPN-tunneled-VNC connection to a server in a friendlier country. But again that's encrypted data and your cellco will know it's out there.

What's your risk doing something you might get caught where the government knows what you are doing, as opposed to getting caught doing something where the government doesn't know what you are doing?

Is the move itself absolutely necessary?

Re:A couple of things.

[Anonymous Coward]

Note that RIM claims FIPS140-2 Level 2 compliance only. As a result, western governments allow only RESTRICTED level data to be used on BlackBerry devices. Which is basically information equivalent to the number of toilet rolls used by a government department. Wait until FIPS 140-2 Level 3 compliance comes before thinking about putting or accessing sensitive data on a mobile phone - especially in dangerous parts of the world. Level 3 isn't so far off - NFC/mobile payments technology is driving the charge, and microSD solutions are already on the market (see GO-TRUST). Also, beware malware - encrypted data is great until it is decrypted and some nasty in-memory utility starts sniffing....

Re:A couple of things.

[Anonymous Coward]

"data you send/receive is going to go through Blackberry's servers" that's not true, happens only if you subscribe to Blackberry service. This can be avoided by having an unlocked device with a common SIM card and run WIFI. If you keep all the files off the media card and the password attempts are exceeded, the device wipes itself.
Not sure what kind of older BB devices those features have.

With encryption, safe to some extent - true and in US you can supposedly take the 5th for not giving out your passwords to access. I am sure there are ways to get a password out of you - in every country if "country feels endangered".

Re:A couple of things.

[Anonymous Coward]

Blackberry has handed over its encryption to various governments around the world from pressure. they aren't safe anymore. The UAE and India deals top the list in my memory.

Re:A couple of things.

[muckracer]

> (1) As far as encrypting the data on the phone itself, I'd recommend Blackberry if you can swing it. It's the only phone I know of
> that has the capability of actually encrypting the filesystem, though maybe that's changed.

Since you have full access to the OS, can you do a full LUKS, perhaps even on LVM, setup on the N900? Anyone know?

Re:A couple of things.

[Anonymous Coward]

[Citation needed]

Solution.

[Zurk]

I have the same problem. I am not in a restrictive country, however my phone lines are tapped on a regular basis since i deal with defendants. its not paranoia -- they really do tap phones of attorneys to get around atty/client and ive seen the records more than once. I use an SSH connection to a tomatousb router (ASUS RT-N16) and forward ports to my N810. you can do the same with your N900. this allows me to do VOIP directly and also share the same connection locally by letting my N810 serve as a local hotspot. All traffic is encrypted with SSH until it reaches my home which is on a dynamic ip anyway. This has worked against local and fed agencies but may not work against NSA/big brother type agencies or against foreign government state departments. You need a fast upload connection (my 25/2 Mbps cable connection works fine). For anything more than the usual calls i meet people in person at the office. meeting in person is covered by priv and works well.

Re:Solution.

[Bromskloss]

they really do tap phones of attorneys to get around atty/client and ive seen the records more than once.

I don't think I understand the situation here. Who are "they"? Are you the attorney? Does "atty/client" refer to some set of laws that restrict whom "they" may bug and not?

Re:Solution.

[Anonymous Coward]

they are one of :
1. Local LEO. this is your local police department.
2. FBI for more serious cases.
atty client refers to : http://en.wikipedia.org/wiki/Attorney-client_privilege

Re:Solution.

[Anonymous Coward]

http://en.wikipedia.org/wiki/Attorney-client_privilege

Re:Solution.

[BluBrick]

I am not in a restrictive country, however my phone lines are tapped on a regular basis since i deal with defendants.

Y'know, if the second part of that statement really is true, you might just want to re-think the first.

Re:Solution.

[Anonymous Coward]

they really do tap phones of attorneys to get around atty/client and ive seen the records more than once.

I call bullshit - either you've fallen victim to your own paranoia (stop watching Glenn Beck) or you're not doing your FUCKING JOB. If you've got evidence of this sort of seriously illegal wiretapping, go to court with it...

Re:Solution.

[calmofthestorm]

I don't follow; it's legal for them to tap your phone but not put a bug on your person/office and record face-to-face conversations?

Re:Solution.

[Anonymous Coward]

I'm not him, but one would assume that he's the attorney and that they're violating attorney/client privilege. In other words, the right of the accused to speak privately with their lawyer.

Re:Solution.

[guruevi]

Welcome to the US. If you're speaking on a phone, you're not talking in private, if you're talking in a room where other people are or have been, you're not talking in private. Better-paid attorneys will actually sweep the rooms regularly for bugs and have external audits performed.

Why you ask? The duty to keep the attorney/client privilege is not on the state but on the attorney so the state could get a warrant (or not if you're DHS/FBI, the Patriot Act cares for it) for the wiretapping of an attorneys office if they could demonstrate (or not) that it could further their case. If a cop 'accidentally' overhears a conversation between an attorney and his client, it can be used or even if it can't be used in court it could be used in questioning and pressuring. The only exception to that is at a prison or a state office where the attorney or client can request a private area to conduct their conversation (again, duty is on the attorney or his client to request such privacy) but most likely they won't carry on a conversation in those settings - the focus would be to get them out of there first without saying too much if possible.

Re:Solution.

[SilentChasm]

I'm assuming "they" refers to the government/police and "atty/client" refers to attorney-client privilege. I would make a guess they do so by claiming the phone conversation is not private (or at least private enough to be protected) but IANAL.

Re:Solution.

[retchdog]

sorry, accidental negative moderation. undoing. fuck this trackpad. mod this message down.

Re:Solution.

[Anonymous Coward]

wiretapping phones without a warrant is not illegal under the PATRIOT act.
also see :
https://litigation-essentials.lexisnexis.com/webcd/app?action=DocumentDisplay&crawlid=1&doctype=cite&docid=27+Nova+L.+Rev.+475&srctype=smi&srcid=3B15&key=f15f91a354e81ca5e7a3f6e5a9225d9b

Re:Solution.

[Anonymous Coward]

meeting in person is covered by priv and works well.

This statement does not seem 100% accurate. Perhaps you should verify that! Secured glass room with a faraday cage perhaps?

Moxie Marlinspike and Whisper Systems

[Fnord666]

Consider giving Whisper Systems "TextSecure" and "RedPhone" applications a try. I have had good luck with them. I don't know if they have been ported to S60 yet.

Re:Moxie Marlinspike and Whisper Systems

[godel_56]

Consider giving Whisper Systems "TextSecure" and "RedPhone" applications a try. I have had good luck with them. I don't know if they have been ported to S60 yet.

From Whisper Systems FAQ:

"10. Does RedPhone support international numbers? For the initial Beta, RedPhone is unfortunately US-only. We will be adding international calling support in the near future. "

consider steganography over cryptology

[smoothnorman]

I'd be most worried about the: "he's using techniques which we can't crack. so he's really up to no good, and we must therefore have him 'pay us a visit'" (cf the usual: http://xkcd.com/538/). So perhaps you should consider communication that doesn't trivially look like communication that's subversive to the powers-that-are? Just something to mull over; because you see, the birds do fly west on a sunny day.

Re:consider steganography over cryptology

[Anonymous Coward]

-.- I see what you did there.

Re:consider steganography over cryptology

[izomiac]

I was just about to pop in and say that. Plausible deniability is the only sane choice for this environment. It basically doesn't matter to you if your encryption is never broken if they just take that as an admission of guilt.

IMHO, the way to go would be an android phone with an extra /data/ partition that's encrypted, and swap them out using the terminal. Be sure to use a strong screen lock (i.e. a long password or very long series of numbers, no patterns). That way, you have a benign /data for investigators, you get *everything* (i.e. thumbnails, logs, etc.) encrypted, and if they question you about the partition you can feign ignorance and claim that it must be a corrupted flash chip. All that said, I'm not sure how technically feasible this is, but it seems straight-forward enough with root access and some familiarity with the Linux terminal.

Re:consider steganography over cryptology

[Anonymous Coward]

But really long passwords can be harder to remember when they're torturing you for the password

Re:consider steganography over cryptology

[izomiac]

Put an easy one on the benign /data partition, and a hard one on the encrypted one. That way, if you're about to be captured, turn off your phone. If you're already captured, tell them it's been buggy lately and to do a battery pull. The point is to force a reboot of the phone, which conceals everything.

Re:consider steganography over cryptology

[hoadlck]

All of my passwords are "AhhhhThePainICanNotTakeIt". This way even if I break, they will never actually get at my data.

What's missing on the N900?

[vadim_t]

It has support for OpenVPN, SSH and tor out of the box. There was one guy in #maemo I think that said he succeeded at implementing full disk encryption, you might want to come there and ask. And if you install kernel-power you'll be able to be use iptables, which should help with making sure only what you want gets in and out.

Now, will encryption help you? What is going to happen to you if you're arrested and suspected of accessing something you shouldn't? I'm thinking that in such a place, if they find you have a heavily encrypted phone they're just not going to let you go if they can't get data off the device, and refusing to tell the password might not be a great idea.

Perhaps you should look more at plausible deniability. Try to set up the phone in a manner that is as un-suspicious as possible, make sure nothing incriminating gets logged on the device, and do all your suspicious activities on some remote server, with some panic system that can remove anything suspicious like tor or ssh without leaving a trace if you get in trouble.

For testing what gets stored, you could try using rsync. Sync the entire phone, do something like loading a website, sync again and see what changed.

Re:What's missing on the N900?

[westlake]

Perhaps you should look more at plausible deniability

"Plausible" is in the eyes of the man holding the cattle prod.

Re:What's missing on the N900?

[vadim_t]

Yes, exactly.

The cattle prod man is certainly not going to be happy if he finds encryption, proxies and so on. So the goal would be to make it look like a normal phone with nothing unusual or interesting on it.

Re:What's missing on the N900?

[Anonymous Coward]

"You were right. All it took was showing him the hardware store catalog, and he gave up the passwords. Let's see what exactly he's been hiding on that encrypted partition...
What the hell? 500Gb of furry pictures?"

Re:What's missing on the N900?

[Eunuchswear]

So the goal would be to make it look like a normal phone with nothing unusual or interesting on it.

He's fucked. The N900 is not 'a normal phone' and it only has interesting and unusual stuff.

Re:What's missing on the N900?

[Anonymous Coward]

"apt-get install truecrypt"

it is already in the repos

Re:What's missing on the N900?

[vadim_t]

Unfortunately the N900 only supports ~59GB of furry pictures (27GB available on the device + 16GB on SD card)

Re:What's missing on the N900?

[Anonymous Coward]

Yes, exactly.

The cattle prod man is certainly not going to be happy if he finds encryption, proxies and so on. So the goal would be to make it look like a normal phone with nothing unusual or interesting on it.

In a word: stenography

Secure Imap/Smtp + SSL in browsers

[icebike]

About the best you can do with off the shelf phones is to use an email client that supports secure communications, and visit
web sites using ssl only. (not Slashdot).

You could try some of the secured proxy browsers such as https://www.the-cloak.com/ (self issued certificate - so due diligence required)
as a way to browse sites like Slashdot that don't offer secure connections.

Re:Secure Imap/Smtp + SSL in browsers

[Anonymous Coward]

Here's an interesting question: How hard would it be for a foreign hacker to hack some email provider's web servers and grab the private SSL cert? Is that completely impossible in today's IT environment? Then, back in their home country, do a "man in the middle" and intercept the SSL traffic destined for the email provider, etc. etc.?

Re:Secure Imap/Smtp + SSL in browsers

[muckracer]

> How hard would it be for a foreign hacker to hack some email provider's web servers and grab the private SSL cert?
> Is that completely impossible in today's IT environment? Then, back in their home country, do a "man in the middle"
> and intercept the SSL traffic destined for the email provider, etc. etc.?

They don't even have have to in most (governments) cases. All they need is their local friendly and trusted CA to sign a few MITM certs for them....

Blackberry + BES Express

[ballwall]

Set up a BES Express server, and get a BlackBerry. I'm not sure you can find equivalent security on any other platform. The BES Express server (free) offers transparent VPN. The devices themselves are unmatched, security-wise (though you'd be stepping back like 5 years in features). Email might be a problem if you don't want to also run exchange or lotus domino, but you could easily set up an IMAPS server and use that.

Re:Blackberry + BES Express

[molo]

Didn't blackberry roll over for the governments requesting intercept capability last summer?

Either way, I don't trust BB that much.

-molo

Re:Blackberry + BES Express

[Anonymous Coward]

Item:
BlackBerry Enterprise Server Express
that supports up to 75 users on the same
server as Microsoft Exchange or
Windows® Small Business Server
Requirement:
Visit www.microsoft.com to see the requirements for Microsoft Exchange or
Windows® Small Business Server
BES Express server may be "free", but.... you want the other stuff legal - or???

Re:Blackberry + BES Express

[no-body]

and.... you'll need a SQL server too - all that BES environment is Microsoft server based. Not sure how much that is. Once you have the server, you'll need access to mobile network for your device(s) from BES - assume that's not free either. Good luck!

Re:Blackberry + BES Express

[ballwall]

Ack, I didn't realize how crazy the system requirements were for a BES. Perhaps not the best solution. Though if you set up your own VPN and IMAPS server the devices will still be the most secure available (keys never leave the device).

Re:Blackberry + BES Express

[netsharc]

If you use your own BEServer, it encrypts traffic between the phone and the server using keys known only to it and the phone (I think during pairing the server tells the phone its public key, the phone generates a key-pair, encrypts its public key using the server's public key, and transmit it to the server -- this is probably a wrong explanation, since the public key is supposed to be public, why should it be encrypted before transportation), so not even RIM can see what the data payload is, if you trust their marketing material... and it seems a lot of government agencies (e.g. the German Security Agency) do.

BlackBerry even does bogus CPU cycles to prevent attackers from seeing which part of the CPU/RAM is warmer than the others and gain information about their en-/decryption from that...

Re:Blackberry + BES Express

[PsychoSlashDot]

and.... you'll need a SQL server too - all that BES environment is Microsoft server based. Not sure how much that is. Once you have the server, you'll need access to mobile network for your device(s) from BES - assume that's not free either.
Good luck!

It includes an MSSQL Express Instance. Which is free.

So, okay, let's be real. If you're one random paranoid guy looking to encrypt his phone transmission this platform isn't for you. On the other hand if you're like a huge portion of the business world and already have some Windows infrastructure, this is a really, really good solution.

BES Express is free and estimated scalable to 3,000 users on one box assuming a hefty box. One of the things I like about BES the most as an IT guy is the easy of individual phone setup. Tell users: run Enterprise Activation, put in your e-mail address and the following (throwaway) password. That's it. No concern that the device needs to have your certificate installed, or that it's not going to detect what port your IMAP/POP server is running on, or that there's going to be some weird interoperability issue with TLS on or off or SSL on or off, or any of the surmountable but ANNOYING things that go wrong on the Android and Apple (I refuse to call the iPhone's OS by what Apple wants me to, sorry... IOS is a Cisco OS) platforms.

Re:Blackberry + BES Express

[no-body]

In theory, I would think that everything could be easily port to Linux - not sure what is all in use - Apache Tomcat based-something, SQL database & what have you. Do they dare to do it? The mail part - Novell-Groupwise, Lotus should be running on Lx anyway... Big money politics and some phonecalls from big brother may be in play - maybe some support channels as well or just resources - they probably have their hands full with competing - or trying to - current forces. . You don't need a BES for VPN I would think - posted about unlocked Blackberry using WIFI earlier - if it will go through customs... Could use https or ssh too - haven't gotten a free ssh client to work yet..

Re:Blackberry + BES Express

[no-body]

Where should the BES be? Inside foreign country or homeland US? In any case BES connects to Blackberry Infrastructure (BB Router) to user's devices (Wireless phone network). If you use BB in foreign country in connections with a BES, you will go through BB Infrastructure which seems to be open to governments in some foreign countries. IMO using a Home-BES Express defeats the purpose. Cost to use BB infrastructure is unknown to me but surely exists on top of Windows Server licensing issue.

Re:Blackberry + BES Express

[Anonymous Coward]

In any case BES connects to Blackberry Infrastructure (BB Router) to user's devices (Wireless phone network).

The BB's connection to the BES is encrypted.
All your traffic goes through the BES (unless you configure it otherwise).

BB Infrastructure which seems to be open to governments in some foreign countries.

Only BIS (not BES) - there's nothing RIM can do for governments wanting access to BES traffic.
more info

Cost to use BB infrastructure is unknown to me

free, as in beer (part of the service plan from your wireless provider)

from the link:
Q: Am I going to have to pay an extra fee per month to use this?

A: BlackBerry Enterprise Server Express is free to all businesses – there is no software licensing cost and no client access license fees. For you, the end user, the only cost is the internet-enabled BlackBerry service plan from your wireless service provider. (This means if you can browse the Internet from your BlackBerry smartphone today you are already on a service plan that can be used with BlackBerry Enterprise Server Express).

Re:Blackberry + BES Express

[bherman]

They allowed access to the encrypted BBM (If you aren't using your corp encryption key) and I think BIS (POP3/IMAP). They have stated that any country wanting access to corp BES data could not be accommodated since they each use their own private keys.

Re:Blackberry + BES Express

[bherman]

BES should be in the US, the data will flow through the foreign carrier but it will be encrypted. So unless you are a high value target, I don't think they'll spend the resources to decrypt that data. It would take a little while.

Re:Blackberry + BES Express

[Anonymous Coward]

I'm pretty sure RIM had to turn over their protection to the Saudis to continue doing business there.

Re:Blackberry + BES Express

[PsychoSlashDot]

BES should be in the US, the data will flow through the foreign carrier but it will be encrypted. So unless you are a high value target, I don't think they'll spend the resources to decrypt that data. It would take a little while.

The correct answer is that the BES should be wherever it isn't like to be be seized. I'm not entirely sure given some of the entertaining news in the last year or so that the US qualifies. Still, ultimately the model is that BES is one end of a secure transmission system. If a government seizes that server, they've already got access to your datacenter and can just hit the mail server itself.

Having BES exist in a foreign country isn't any less secure.

Re:Blackberry + BES Express

[PsychoSlashDot]

That's for BIS, which is basically where you use your Blackberry without having your own server infrastructure.

Re:Blackberry + BES Express

[bherman]

The question was asked as "should the BES be in the U.S. or the foreign country." Given those two options the better place would be the U.S. since the OP was concerned about the foreign country to begin with. Your point about the physical access is correct, however if you have encrypted mail stores and you encrypt the handheld you could conceivably create quite a headache for anyone who even has access the physical box or the handheld (assuming you didn't remote wipe it anyway).

Re:Blackberry + BES Express

[taylortbb]

You can get a hosted BES/Exchange setup for a small fee. You have to have a trusted hosting provider in a country you consider safe.

Unlike many of the custom Android solutions being suggested on here, this requires an unmodified BlackBerry in a setup that is standard for pretty much any company. Having a setup which is highly customized for evading surveillance might work well, but if you're caught with it the consequences could be severe. Having something which is standard fare among business travellers makes you far less suspicious. Many oppressive regimes will throw you in jail even without being able to decrypt your data if they think it's suspicious enough.

As other posters have pointed out, RIM only provides access to BIS data. If you're running BES (an enterprise server) there's no way RIM can hand over your data. They've had the BES server software audited by independent agencies to confirm its security. Additionally, the on-device security is excellent. Unlike certain other mobile platforms there have been no attacks that can bypass the password lock screen. Additionally there's a full set of encryption and memory cleaning options.

Only one answer: Blackberry

[Anonymous Coward]

Read through their many certifications:

http://us.blackberry.com/ataglance/security/certifications.jsp

Re:Only one answer: Blackberry

[Anonymous Coward]

Those certifications aren't that fantastic.

I can't help wondering

[Anonymous Coward]

How long it will be people start thinking the same about moving to EU

I am not sure you want everything encrypted - it may draw attention to you, where as a limited amount may hidden in https type communications

Two Things to Worry About

[Anonymous Coward]

The think you have two different problems being in a restrictive country as you describe. 1) Hide the traffic that you are sending on the Internet and storing on your local system 2) Hiding the fact that you are hiding stuff.

The first part is relatively simple, in my opinion, by using an encrypted proxy or VPN connection to your remote server and using a form of encrypted file storage for local system, such as TrueCrypt. The second problem is much more difficult to deal with. Since you are probably breaking the law using the encryption, hiding the fact they are a hiding stuff may be just as important. As far as I know, there isn't a good solution for this. Your best bet in my opinion is to attempt to disguise the traffic as something else, like using port 80 for the proxy port, or something similar, and leaving a simple, non-threating web page up when you aren't using the proxy server on that port.

Legally?

[Anonymous Coward]

Many of these 'more restrictive' places have a ban on encryption of any reasonable strength, you might not be ABLE to use ANY at all. But if you are looking to do it anyway, then ITAR and cryptography regulations be damned - just claim to be from the US, and go full strength encryption... of course, if you end up going to prison for the rest of your natural life being tortured there until you died - then it's not our fault.

Your best bet ...

[tgd]

Is not to use those services. Generally speaking, if the country is that restrictive, they probably will not take kindly to a foreigner trying to bypass the restrictions.

A good rule of thumb to travel: obey local laws. If you don't like them, don't go there. As a foreigner, you are in a pretty risky spot to try to take matters into your own hand.

Re:Your best bet ...

[Anonymous Coward]

Is there a local law against encryption?

The problem isn't the laws, it's the lack of "the rule of law".

Re:Your best bet ...

[gl4ss]

I don't think that it's well defined whats Legal and for who in the country he is going to, same drill as with ussr - the only way to move through there doing business was to wing it, as nothing was defined - everything was always up to the local police(mp or not) and whoever happened to wield power for whatever reason in whatever area(doing business in russia is still hard for the same reasons, ikea lost a billion - this is also why it's a necessity to be able to withstand HEAVY drinking, to get to know the people and how things somewhere could be arranged).

that's why they're rioting, they got nothing defined for them except servitude of undefined kind, so they might just as well start making a stand.

Re:Your best bet ...

[Anonymous Coward]

Thank goodness someone posted the sane & obvious reply.

You're deluding yourself.

[Stoutlimb]

You're going to a restrictive country with little human rights, and you think that encryption will keep you safe?

I think that XKCD put it best... http://xkcd.com/538/ I'm surprised nobody's posted this yet.

Re:You're deluding yourself.

[Anonymous Coward]

I think it's more likely that they'd just imprison the guy for using encryption at all. Big Brother doesn't like blind spots.

Re:You're deluding yourself.

[Anonymous Coward]

think that XKCD put it best... http://xkcd.com/538/ I'm surprised nobody's posted this yet.

They have, but you were only 11 minutes after.

BackTrack != Secure

[keckbug]

I feel compelled to point out that while BackTrack is a great distro, it's primary goal isn't really being secure from outside intruders. It is designed for auditing and testing other systems. I'm sure with a reasonable effort you could lock it down to be relatively secure, but you're looking at the wrong tool for the task. Hell, it runs everything as root by default.

Re:BackTrack != Secure

[Anonymous Coward]

Mod Parent truth..

There's quite a number of nasty payloads sitting around in backtrack. Not something you'd want if you're looking for security.

Re:BackTrack != Secure

[Anonymous Coward]

I think he wants SELinux or something like that not BackTrack.

Be realistic here

[AdmiralXyz]

If you're not a high-priority target or planning on creating civil unrest, than this restrictive government doesn't care about you. If you are, then encryption isn't going to save you. They'll either pull off some side-channel attack, like a rootkit on your phone that no amount of encryption is going to subvert, or just throw you in jail for using encryption at all.

I'm all for security, but a lot of Slashdotters really need a sense of perspective.

StrongVPN is what you want

[Anonymous Coward]

Get StrongVPN. They have screencasts for how to set it up for your Droid, iPhone, Mac, Linux, or PC. Basically, you configure your device to forward all internet traffic through the VPN server. I use it so I can access US content (Hulu, Netflix, etc) since I live in another country right now. It's always funny to get radio ads for the Miami market while listening to Pandora.

You can't beat $55 a year!

Check whether this is legal in your police state

[Bozovision]

Before doing this you may want to check what the local laws are. Police States do not like privacy. Encryption is not always legal. If you find it's illegal you will probably also want to check what the penalties are.

Most current gen phones will do tunnels...

[uncledrax]

the iPhone can do PPtP tunnels.. I haven't played on my Nokia N800, but I'm positive it can do it as well.. and I can't see any reason why you couldn't do it on an Android. I believe the Crackberry has such a large business-centric user-base, I'd be very sup

Setting up and using an encrypted tunnel is pretty basic and most recent generation phones you'd even want to bother 'surfing' on should be able to do this. So if you're shopping for a new device, I'd just add this to a check-box list of features you want, and focus on other things.

High Quality Encryption

[imscarr]

This page lists many High Quality Encryption devices.
http://www.jproc.ca/crypto/menu.html
Look at the KGV series

How about not?

[LukeWebber]

Screw that. Just stay home. Watch pr0n and drink beer.

ssh

[markdavis]

It sounds you are using your phone to provide IP to other devices. You can just use ssh on those "other devices" to port forward anything you like. There is no need for any special phone nor software running on the phone when the IP traffic itself is already encrypted.

Bad Idea

[cypherdtraitor]

I would recommend just censoring yourself.

The fact of the matter is that if the country is actually using sophisticated techniques to look for spies, they will be actively looking for data traveling in an encrypted form to the united states.

It would be a shame to be captured and interrogated because the tyrants didn't know that "secret message" was about how much you hate your boss.

Why no SatPhone?

[Anonymous Coward]

The only really efficient and reliable way to do this is via SatPhone.
Why not?

BackTrace Secure?

[ProfessionalCookie]

Since when is BackTrace a secure OS? I was under the impression that it was a live distribution with a bunch of penetration testing tools with Root as the default user. In fact I believe special configuration is required to even create a non-root user. Hardly an OS built for normal everyday use.

I'm pretty sure the poster doesn't actually know what they need, want or are asking for, but best wishes.

Don't forget

[Anonymous Coward]

When you enter the USA, they can search and seize your electronic equipment, encrypted or not.

Re:Don't forget

[Anonymous Coward]

But they can't make you give up your password. And luckily they're still afraid of lawsuits, so they have not resorted to shipping non-Arab-looking, non-Muslim Americans to black sites yet. Although they did jail a blonde Icelandic girl with no food nor access to a phone call for 24 hours once. Yeah, in light of the way the Americans treat people (water-boarding, beating them to death), no food for 24 hours is a rather pleasant experience, isn't it.

And apparently their checks are useless, Jacob Appelbaum's (part-time volunteer for WikiLeaks and Tor, supporter of the Egyptian revolution) USB sticks got confiscated, he knew he was going to be harassed, so he dd'ed the Bill of Rights onto the bootsector beforehand, and their useless program couldn't see that...

Posting anonymous, but I think I've signed my name to anti-American-fascism statements before, they'll still probe my ass when I visit that terrorist regime...

n900 is probably the most flexible

[xeno]

Some resources for the n900:

----- file system encryption--
Truecrypt for true cross-platform encryption on the phone's non-boot volume
  (available by default in the N900's Extras-Testing repository)
A nice script to simplify use of TrueCrypt (no screen icon = non-obvious = good)
  http://forums.internettablettalk.com/showthread.php?p=597269
Also note that for your pc, you can put the x86 tc.exe on the phone's unencrypted boot volume, ...and then mount the phone's encrypted volume from the card, thru 1 usb connection

----- IP encryption
Tor is available as a package and works well, tho with caveats
  http://www.torproject.org/docs/N900.html.en
SSH is also available

----- semi-secure voip
Skype support is inbuilt (tho sometimes suspect w/proprietary encryption & whatnot)
  configure thru Settings>Connectivity>VoIP and IM.
Run your own Asterisk PBX on the n900 with an encrypted config/tunneled
  available in the Extras repository

----- alt boot options
option to boot alt OS hidden on card
  http://wiki.meego.com/ARM/N900/Install/Dual_Boot
  http://neopwn.com/ (sometime soon, one hopes)
option to carry a hidden/alt bootable PC OS in your phone
  http://zitstif.no-ip.org/?p=451

Re:n900 is probably the most flexible

[Anonymous Coward]

I wouldn't call TOR a means to protect confidentiality, more anonymity, I have heard stories of TOR nodes sniffing plenty of traffic en route.

Consider having a friend/family member set up a VPN that you can use in America. It will be slow depending, but actually more secure from prying eyes in that country. Then use Skype over that VPN and voila secure voice :) get Open VPN for driod or even cisco any connect for your iphone

Port scan your phone before you leave the country and ensure there is nothing open that could lead to someone owning your phone. Just root your phone and install droidwall or something to assist :)

Own the network, own the phone

[Anonymous Coward]

If you own the network, you own the phone, plain and simple. Back doors are built into the protocol/network infrastructure. Up until recently, BlackBerry would have been the way to go. Now even they have been required to allow back doors to the platform in foreign countries. It is what it is, you are in their country, using their network, they have the ability to do what every they want. In their eyes there is no such thing as privacy while in their country. Your best bet is to get a dumb phone and only discuss things you want other people to hear. Use your smartphone as a PDA, off the network.

Re:Own the network, own the phone

[cool_arrow]

I've wondered if surreptitious software installation could be defeated on a GSM device by using some something like this: http://www.bladox.com/doc/sec_ed_ug_en-2.pdf which sits between the hardware and the SIM, and is running a custom made application. With the GSM standard the SIM queries the hardware to find out if it is capable of taking over-the-air updates. This device could spoof what the hardware sends to the SIM so the network operator sees a non-OTA updateable device. Also if the network operator wanted to install a SIM based app this device could capture it. If anything outside of your defined parameters were taking place the device shuts things down. Possible? Please test and report back :D

Android, Symbian, and Maemo

[Weezul]

I'd believe that only Maemo offers moderately convenient gpg encrypted mobile email, not via the default email client sadly, although maybe you could hack that. Afaik, Maemo boasts the only mobile OTR messaging solution too. Android and Symbian beat out Maemo when your talking encrypted voice calls however since only they boast Zfone implementations. If the country is evil enough though, they might not even have access to skype conversations, not sure how skype handles baddies.

Afaik, all modern mobile platforms support virtually all VPN protocols. Android will handle ssh tunnels once you jail break it, presumably the same for Symbian. iPhones, Blackberries, etc. will get messy wrt port forwarding. I'd imagine that only Maemo will offer seamless SOCKS5 support, but maybe Android. VPN also offers the most plausible deniability if they catch you using encryption.

I've cannot comment on encrypting the contents of the phone under Android and Symbian, but Maemo supports some encrypted file systems from Linux and Easy Debian offers all the others. We're hearing about dual core phones running Android and Debian simultaneously. So maybe you should get your encrypted filesystem running on your N900 now, but plan on buying a dual Android & Debain device once your N900 gets long in the tooth?

In practice, you shouldn't really worry too much about your random comments or encryption usage. American citizens won't get harassed too badly unless they're clearly a threat, i.e. an activist, journalist, etc. If your not America, then you should seriously check into the country. Saudi Arabian employers love keeping people there as slave labor by taking passports, even heard about them doing this to French people.

Re:Android, Symbian, and Maemo

[asnelt]

I'd believe that only Maemo offers moderately convenient gpg encrypted mobile email, not via the default email client sadly, although maybe you could hack that.

The Android Privacy guard offers convenient gpg encrypted email for Android too: http://www.thialfihar.org/projects/apg/ It works together with the K9 email client. Also not the default email client but much better.

Stay at home?

[Anonymous Coward]

I'd suggest you don't do anything. If you're going to live somewhere like that why would you want to draw attention to yourself by making it look like you're hiding something? If you've got nothing to hide then no need to hide anything. If you do have something to hide then why go there in the first place?

As a rule of thumb - if you can't live without the pr0n then don't move to a country where having pr0n will get you into serious trouble.

Android works pretty well

[t2t10]

It supports both regular VPN and tunnelling with ssh (or any other command line program). The browser can be configured to go through a proxy if you like. If you want a mainstream phone, that's probably the best way to go. There are also lots of encryption solutions.

iPhone is nearly useless from a security point of view: when the VPN connection shuts down (as it does from time to time), it starts transmitting your data unencrypted; totally unacceptable!

If you want any more control, you probably need to get an N900 (while you still can).

You can get a little flexibility by using a mobile WiFi hotspot and a separate WiFi enabled internet access devices (e.g., Android tablet, Android phone, etc.).

OpenVPN works on Nokia N800

[Anonymous Coward]

OpenVPN works on Nokia N800, so I'd be surprised if it doesn't on the N900.

Find a friend in your home country who is willing to run an openvpn server or get a $20/month VPS plan that allows long running processes like openvpn and make all your non-local connections go through the VPN connection.

You won't be streaming TV or VoIP thru it, but all your other traffic will work just fine and be unbreakable. Always use SSH to remote into the VPN server.

Don't go.

[sdguero]

It's not worth it.

Technology is not the issue

[lowlands]

Technology is not the issue: get your favorite OS instance from your favorite cloud provider/hoster or whatever, setup ssh and openvpn. Part 1 done. Now hop on irc.freenode.net to #asterisk or #freeswitch and ask around for a provider that offers encrypted SIP calls using TLS/SRTP or even ZRTP using non standard ports (like 80, 443, 25 etc.). If your new overlords don't block ports perhaps Skype works too. Use creditcard to throw some cash at the service, configure phone. Part 2 done.

Bottom line is that when you are in a country with scary overlords with many scare drones who like to see you in a scary basement with scary tools you want to keep your head down, do the work, grab the pot of gold (I hope) and get the hell out. If you are from the US be prepared for some serious negative sentiment towards you and the US in general. Do not comment on anything political ever. Do not comment on the pothole in the street, the food, the music, do not comment on girls/women ever. Basically do not comment on anything. Just smile, shut up, respectfully say you have work to do and back out of the discussion as fast as you can. And remember, your biggest "friend" is probably the guy that reports about you every night and gives the other scary drones the intel based on which they might decide to drag you into one of their basements. Do not confide in any person. Oh and just because some other expats say there's no problem with having a few alcoholic beverages at home does not mean that it's save for you. Just imagine the scary basement with the scary tools before you do something that is totally normal in the US but might be or is conceived as insulting and illegal in your nice new restrictive country.

I hope it's worth it.

Re:Technology is not the issue

[Anonymous Coward]

Bottom line is that when you are in a country with scary overlords with many scare drones who like to see you in a scary basement with scary tools you want to keep your head down, do the work, grab the pot of gold (I hope) and get the hell out. If you are from the US be prepared for some serious negative sentiment towards you and the US in general. Do not comment on anything political ever. Do not comment on the pothole in the street, the food, the music, do not comment on girls/women ever. Basically do not comment on anything. Just smile, shut up, respectfully say you have work to do and back out of the discussion as fast as you can. And remember, your biggest "friend" is probably the guy that reports about you every night and gives the other scary drones the intel based on which they might decide to drag you into one of their basements. Do not confide in any person. Oh and just because some other expats say there's no problem with having a few alcoholic beverages at home does not mean that it's save for you. Just imagine the scary basement with the scary tools before you do something that is totally normal in the US but might be or is conceived as insulting and illegal in your nice new restrictive country.

Australia is a tough country to do business in.

Plausible deniability?

[c0lo]

Entering as a foreigner in the country will flag you for sure. Man-in-the-middle attacks are possible.

I'm not worried about encrypting SMSs or traditional voice traffic, but I would like all IP traffic as secure as possible.

If your traffic doesn't require real-time reporting of events (i.e. a delay of 2-3 hours between the event and the report is OK) and doesn't require large amount of data (i.e. text reports rather than video).
1. As you control both ends of the communication, consider a prearranged set of one-time pads
2. Plausible deniability - including steganography and Rubberhose filesystem
3. Netbook instead of a smart-phone? (easier to arrange, no need to hack the phone)

Good luck.

Re:Plausible deniability?

[jmuzz]

3. Netbook instead of a smart-phone? (easier to arrange, no need to hack the phone)

Exactly, why trust any phone hardware? Too much unknown in the drivers/custom firmware and serials linking coms to your device and location within 1km.
99.9% of phones wont have non standard security features setup, any which do are just asking to be confiscated for further investigation, which is inconvenient if nothing else.

Encryption of stored data is useless, your options are to supply the key, or to be charged with some other falsified charge such as drug possession which you will have no defence against.

If secrecy is important it is better to stick with a notepad PC, security is much more established, sensitive material can be hidden amongst 100GB of junk, or stored on "flushable" memory cards. VPN's/remote desktop back to the office are perfectly normal for business people. You can old school dialup modem from any telephone line.

Re:Plausible deniability?

[Kakari]

And for a lovely TRNG - check out what this guy did with a satellite receiver - if you've got some time, you can probably generate several gigabytes of one-time pads. You'll have to protect them and destroy them after use, but you could probably have enough for all your bandwidth needs while in country.

Figuring out a tunnel that uses one-time pads as a key is left as an exercise to the reader.

Re:Plausible deniability?

[cool_arrow]

very cool project.

Re:Plausible deniability?

[Duradin]

For #2 make sure you're worth enough alive so when they discover your "clever" scheme the response isn't "How cute. He's a spy. Execute him. Then perhaps we'll bother to try decrypting his device."

Re:Plausible deniability?

[c0lo]

What in the TFQ you didn't exactly understand?

"Soon I'll be moving to one of the hot, culturally restrictive countries which has recently been in the news ...Which smart phones are the best for a) encrypted storage, and b) encrypted transmission?

As the person is already committed to do it, can you recommend better schemes? If so, I'm sure the person asking will be grateful.

Re:Plausible deniability?

[Eunuchswear]

Exactly, why trust any phone hardware? Too much unknown in the drivers/custom firmware and serials linking coms to your device and location within 1km.

He's got a N900. Do you think 'they' have hidden something in the OpenGL drivers? Or the battery driver? Most of the rest of it is open source.

Re:Plausible deniability?

[muckracer]

> you can probably generate several gigabytes of one-time pads

Now all we need is a mail client, that can actually use that generated random data for OTP encryption...

Re:Plausible deniability?

[Duradin]

Yes. If you don't *NEED* (not just want) encryption don't use it and don't do things you'd like to do but don't *NEED* to do that would require encryption. Just having the tools, or the appearance of having the tools, may be enough to get someone interested in what you're up to.

Some governments don't care about "clever" little tricks of legality and will just throw the book at you.

Could be dangerous ...

[gstoddart]

Before you start trying to figure out how to circumvent being spied upon by the host government, maybe you should look into the possible consequences of this. It may well be that if they find out that you're doing this, things could really turn out bad for you.

It's generally a good idea to try to actually obey the laws of the country you're going to, especially if it's as volatile as you say it is. If you're a foreign national and don't have any sort of diplomatic protections, you could be playing a risky game.

Re:Could be dangerous ...

[wakim1618]

I currently live in and have been working in one of those 'hot' countries for several years. First, your concerns about privacy seem misplaced to people who live around here. Tracking is for the general plebes who live there and have nowhere else to go. As a foreigner, your behaviors doesn't matter as much so long as you are not part of the problem. If you are a problem, forget about your supposed rights and privacy that you believe that you are entitled to.

First, the government/state/security/police can just break into your house whenever it wants, and your only recourse is that you are important enough that your embassy or company will raise a big enough fuss. Otherwise, you are out of luck. Unless, you want to carry around your laptop with you all the time, you can assume that they can get physical access to your computers when they really want. Same for your phone.

The government/state/security/police will question your building security, maid, nanny and almost certainly obtain their cooperation in tracking your movements and rumaging through your personal belongings. They also have access to all your financial transactions within the country, and all cross-border movements.

Is it your financial privacy that matters to you? Or is it that you do not want your phones or computers seized? In the latter case, just keep a low profile and don't cause trouble.

Re:Could be dangerous ...

[Anonymous Coward]

Maybe (s)he's aware of the risks and prepared to take them. Maybe whatever (s)he's doing in that country is more important than one person's safety. Sometimes unjust laws need to be broken.

Re:Could be dangerous ...

[js_sebastian]

Before you start trying to figure out how to circumvent being spied upon by the host government, maybe you should look into the possible consequences of this. It may well be that if they find out that you're doing this, things could really turn out bad for you.

It's generally a good idea to try to actually obey the laws of the country you're going to, especially if it's as volatile as you say it is. If you're a foreign national and don't have any sort of diplomatic protections, you could be playing a risky game.

I don't think he is planning on organizing a coup or bombing a mosque. From how i read TFS it seems to be just a regular guy who wants to continue to do his email, post to slashdot, facebook, browse the web, without being restricted by a firewall or having his passwords sniffed or his privacy compromised. Setting up a VPN and doing all traffic through it seems to be a pretty reasonable approach. I'm pretty sure businessmen VPN into their company network from this kind of country all the time, so I doubt it will raise such huge red flags unless he is doing other activities that get him attention (say, getting arrested at a protest, or interviewing political activists or whatever, in which case stealthier security measures and plausible deniability are certainly advisable ).

Re:Could be dangerous ...

[gstoddart]

Then, I fear, you grossly underestimate what doing encrypted traffic in a 'repressive regime' might cause for personal ramifications.

There isn't a lot of room to quietly do things The Government of such a country might not want you to do.

What you may think is perfectly reasonable might, in your comfortable Western existence, not get you very far in a practical situation in such a country. Any government which might be willing to use force against it's own citizens might not actually give a fsck about you ... You could become an 'example' ... I bet that would be bad.

Flaunting local laws in such a country might not be a wise choice. The consequences might be, well, unfavorable. Standing back from your basement, I posit that you may not actually fully grasp this as something as scary as what the poster faces. Sidestepping state control in a country in which the leader has supreme power does NOT make one safe ... It might make you a target.

Re:Could be dangerous ...

[Anonymous Coward]

No way! Protect your privacy, it is a rare and valuable commodity. This sort of spying occurs on a regular basis under the guise of govt. protections, or "oppressive regimes." It's all about the money and your info is worth money going in or out of their looking glass. Do not become a victim. Protect yourself.

Re:Could be dangerous ...

[js_sebastian]

Flaunting local laws in such a country might not be a wise choice. The consequences might be, well, unfavorable.

It surely depends on the country, but even in most repressive countries encryption is NOT illegal, nor is reading my email, so I am not sure which laws I would be flaunting.

Standing back from your basement, I posit that you may not actually fully grasp this as something as scary as what the poster faces.

I won't take this personally, I think it is the way of slashdot to accuse everyone else of living in their mom's basement while casually dropping comments implying that one has a girlfriend or is a secret agent working behind enemy lines.

Just use https

[MobyDisk]

From what I know, an encrypted data connection is of limited value.

1) If you are using HTTP, the ISP can listen-in on you even if the communication to the tower is encrypted.
2) If you are using HTTPS, and the certificates are properly validated, then the communication is encrypted from the phone to the tower past the ISP and all the way to the web site. They can't listen in on you at any level. The only potential gain I see see to encrypting the data communication as well is that someone can't tell what site you are visiting by intercepting the phone's data connection. (HTTPS doesn't hide that.) But then that can be seen by the ISP.

Also, I'm not sure if you can trust the data encryption. How can you tell that the phone is using it? Or that the tower is using it? Or that it isn't breakable?

Re:Just use https

[Anonymous Coward]

I already posted in this thread as A/C, let's see if I can post...

You're full of crap. The tower encryption is worthless--it's already been broken. Academically. And published.

Breakable RSA is meaningless. Anybody with the means to break it would probably kill to avoid having the weakness known. But the elephant in the room is that you don't have to break RSA to utterly compromise it.

The current build of firefox comes with over 164 root authorities. That's 164 opportunities to compromise every communication this guy makes and kill him.

cite: https://spreadsheets.google.com/pub?key=ttwCVzDVuWzZYaDosdU6e3w&single=true&gid=0&output=html

Sadly, I can't remember the project now...but there's a university student somewhere who wrote a firefox plugin to submit copies of the SSL certificate your browser sees to a server, and then it looks to see if the domain name ever
    1) has the cert change
    2) presents a different cert to different people

And of course the interesting bit...if there's more than one valid cert. Maybe I have it bookmarked at home.

Bottom line...anything *BUT* a self signed certificate with change detection is worthless.

mobile phone app

[Anonymous Coward]

A few days ago someone questioned me about the same problem and if there is a chance to build an app (iPhone in this case) that is able to send SMS like messages encrypted paranoidly in way that if either the server, the line or the clients are unsafe the message still be extremely difficult to be opened by someone else as intended destination.

But as i read these posts i just see it the same way as the other guys who say that it could be an eyecatcher for some instances if you encrypt your messages and cause trouble.

Re:mobile phone app

[cool_arrow]

http://www.bladox.com/doc/sec_ed_ug_en-2.pdf

Encrypted storage on Android?

[Dast]

And what would one use for the first of the two requirements, encrypted storage, on an Android platform? I'd love to hear of a solution.

Re:Encrypted storage on Android?

[h4rr4r]

Truecrypt seems like it would fit the bill. Just need to build the kernel modules.

Re:Encrypted storage on Android?

[certain death]

Honeycomb supports encryption...reportedly.

Re:Encrypted storage on Android?

[KlaymenDK]

...but then, I imagine the Google apps (and quite a few others, no doubt) leak clear text data by the bucket load. Even if you do encrypt your local storage, and use a VPN, I don't think that Google Mail and Maps and MyFace and BootPrints and ... will make use of it. Not to mention all the ad-enabled and profiled free apps, which are sending (anonymised, but still) usage data who-knows-where.

If you want to be paranoid about your smart phone, be smart and use a dumb phone, and a proper PDA on the side.

N900, duh.

[Anonymous Coward]

1. N900 w/ Maemo 5 + POWER kernel (for IPSec) + ipsec-tools (http://natisbad.org/debian-n900) + IKEv2 (optional)
2. the Internets over cell network
3a. home openwrt router + NAT (optional)
3b. home *NIX machine + ipsec-tool + IKEv2 (optional) + squid
4. the Internets over home network (BAM)

I have not successfully implementented IPSec from/to my N900, but it should work with.

Required to Provide encryption keys

[Anonymous Coward]

Remember that in some countries (eg UK) you are legally required to provide all encryption keys to the authorities when asked. To fail to do so is an offence in itself, regardless of the content of the encrypted material.

Re:Required to Provide encryption keys

[Anonymous Coward]

... and if you refuse to hand over those keys you are guilty of contempt of court and go to jail until you cease your contempt .... and if you tell anyone that you have been required to hand over those keys under RIP you also go to jail.

CQ? CQ?

[Aqualung812]

While I think the parent is being funny, Ham Radio would be something that couldn't be stopped as long as you have little power.

Duct Tape can do anything

[Anonymous Coward]

I have OpenVPN running nicely on my Android 2.1 phone. Had to root it, tho.

And since you are rooting it, you shoud be able to partiton you sdcard and setup some kind of encrypted filesystem. I havent tried it yet, but might just to see if is possible.

Also, in a country like that, you might try getting a phone without a camera... just in case.

Duct tape can easily cover up a phone's camera.

getting worse

[Anonymous Coward]

The current status in middle east countries is scary to say the least. Securing your phone or using Tor or even Skype may make them come after you or red flag you. They used to overlook such things but now its different since they feel that their end is near.

Countries like Saudi Arabia are now on highest alert, and their wire taping powers and capabilities are much more than they were during the first and second gulf wars; people would tell you horror stories of innocent comments on the phone during those times that ended them in jail. e.g. if you work at a hospital and were calling someone from your mobile and mentioned casualties related to any event, thats it and you are history; no one is notified and no one can inquire about you. If they don't want you, they will plant a bottle of alcoholic drink in your car and throw you in jail for 3 yrs then deport you or some drugs and have you executed. They rarely use the later methods against "WW" (white western) individuals though.

If you are a native of those countries, then it may be worth securing your stuff and anonymously spreading the knowledge of how to do so. If you are a visitor, the best is to stay under their radars; i.e. no politics and no religion anywhere (work and friends). If you can then just don't go near middle east and try to lobby against their dictatorships (i.e. harass the your elected official).

just my 2 cents

Pwnie Express

[Mad-Mage1]

Pwnie Express sells a N900 with Backtrack installed, dunno how well the phone functions though

Easy!

[Anonymous Coward]

Easiest solution you have full control of:

VPS + VPN= secure. cheap. safe.

It will cost you 20 bucks per month for a reliable system you know is secure because you control the other end. I use both my laptops an android phone to connect to my vpn when ever using public wifi.

This is easy...

[Anonymous Coward]

Get a VPS and a VPN and call it day. You have complete control of both ends. Its easy, cheap, safe, and secure.

It costs me 20 bucks for a server with incredible performance and lets my laptop and android cell VPN in from anywhere.

Simple as that.

Be careful

[Anonymous Coward]

Here are some points to think about:

Once you arrive in your destination country you will most likely use a service provided by your in country operator. I assume this because if you could afford roaming charges for data full time from a US operator overseas, you could probably afford your own communications satellite. So using your new "in country" service provider, let's call it for example, "Mars Mobile", all IP traffic will be going through their core network, even when you are roaming overseas. If Mars Mobile has agreements in place with Mars Intelligence Agency or Mars Secret Police, which in fact is true in most of the world, your traffic is probably being analyzed for possible suspicious behavior. Now, once your phone starts attempting to or is successful at tunneling VPN traffic, this could alert Mars Intelligence Agency and next thing you know you are now on some watchlist, or even worse your person is now under survellience without your knowledge.

My real world experience is that in about 2005-6 while in China we decided to SSH tunnel our entire office IP traffic (about 60 people) to our dedicated server in the USA, so that we could get around the "Great Wall" because all the expats wanted uncensored news. The first time we did this, within 20 minutes our internet was cut entirely. After coming back on in an hour, and attempting to establish the tunnel again, we discovered, that traffic had slowed by 70% over the tunnel, and that two routers in the hops right before the gateway link out of China were dropping packets, but only the tunneled traffic. It looked to us that we had triggered some type of attempt to monitor our traffic, we stopped tunneling. In the coming months we found a bug in our board room, there were several attempts to hack into our office netwokr, two that we knew were successful. Coincidence?

Re:Be careful

[Alex Belits]

After coming back on in an hour, and attempting to establish the tunnel again, we discovered, that traffic had slowed by 70% over the tunnel, and that two routers in the hops right before the gateway link out of China were dropping packets, but only the tunneled traffic. It looked to us that we had triggered some type of attempt to monitor our traffic, we stopped tunneling. In the coming months we found a bug in our board room, there were several attempts to hack into our office netwokr, two that we knew were successful. Coincidence?

No. Your network administration people suck incredible amount of ass, so they can't configure routers in a non-SSL-breaking way, and allow your network to be "hacked" by random skr1pt kiddies.

Use VPN selectively

[Anonymous Coward]

When visiting restrictive countries use their filtered and tapped networks for sending information that does not matter. Let them see and have their fun. If you want to send some secure files or make a secure VOIP call turn on the VPN only for the duration and stay secure. Then go back to letting them see what doesn't matter.
If you do get traced and questioned your very reasonable response is that you were doing some on-line banking.

An unethical suggestion: safety first

[Anonymous Coward]

If you're going to be participating in the demonstrations, do not carry your own phone with you, and do not use your own personal electronics to send sympathetic messages to your compatriots in-country. Tell your friends not to carry their cell phones during the demonstration, either. You must not provide evidence that could link you to the demonstrations or to other demonstrators. You must assume that cell towers will record every time your phone is in an area.

To get the messages out, leave a prepaid pay-as-you-go phone outside the country with a trusted associate, memorize the number, and never call the pay-as-you-go number from your own phone or from any friend's phone. Use it only when you wish to send a message of the demonstrations to the outside world.

• Prior to the demonstration:
  • Go all by yourself or get a long way away from friends who might have cell phones with them. You are trying to not be in the same cell tower area as your associates.
  • Steal someone's phone.*
  • Remove the battery from the stolen phone as soon as possible, certainly prior to going near your home or going back near your friends who might have phones that are powered on.
  • Removing the SIM card is not enough to protect you, you must remove the battery.
  • Away from the scene of the theft, and still away from your friends and home, replace the battery and learn how to put the phone in airplane mode.
  • Figure out if the phone has an option to turn GPS off, then turn it off at this time and leave it off. But do not trust that it is safe because GPS is off.
  • Briefly learn how to shoot video with the stolen phone (while it is still in airplane mode.) Practice shooting a few seconds of video of a non-identifiable subject such as a blank wall or the ground. Do not speak while you are recording the practice video.
  • Figure out how to send the video, but do not actually send it at this time.
  • Do not shoot video of yourself, of your friends, or of identifiable surroundings!
  • When you are done learning, erase the practice video then remove the battery.
  • With the battery removed, leave the area where you practiced and then you can return to your friends.
  • If at all possible, recharge the stolen battery without using the stolen phone to charge it.
• Prior to arriving at the demonstration:
  • Do not carry your own cell phone with you! Leave it powered on in your house.
  • Double check your friends that they are not carrying their own cell phones either.
  • As you arrive at the demonstration, replace the battery in the stolen phone, and immediately put the stolen phone back in "airplane mode" again
• During the demonstration
  • When an opportunity arises, shoot video with the stolen phone. Do not speak while you are recording. Allow the images in the video to speak for you.
  • After shooting the video and as soon as you are in a safer place where you will not be observed, (past the edge of the mob, or at least not in sight of cameras), discreetly turn off "airplane mode" and then send the video directly to the pay-as-you-go phone
  • As soon as you are done sending the video, remove the battery and quietly abandon or discard the stolen phone. If you are in a crowd, quietly drop it at your feet and move away from it.
  • Do not hold the phone after sending the video in hopes of re-using it for a second transmission. It is not worth your life.

* Remember that you are risking the safety of the person you are stealing the phone from. Stealing it from someone who will have a strong alibi but has poor security is good (perhaps from a cleric who will be teaching during the time of the demonstrations, for example,) but do not steal it from someone who might recognize you. And do not steal a second phone from the same person, or return to the same location to steal another phone at a different time.

Re:An unethical suggestion: safety first

[Alex Belits]

If you are an American and are going to participate in political demonstration in a foreign country, you deserve anything and everything that will be done to you.

I'm using OpenVPN for N900.

[Hougaard]

Setup a OpenVPN box somewhere free (VPS Hosting) and install the OpenVPN application for the N900 - Works great for me !

Don't solve the wrong problems

[Confused]

To start off, here's the obligatory xkcd cartoon to go with the question: http://xkcd.com/538/

Having spent some time in those countries, you should be careful to also consider the social aspect of what you want to do. Encrypting data is all fine and dandy, but that will only help against snooping and in case you lose your phone. At a checkpoint full of burly men asking you to show them what's in the file myporn.secret or SoundOfMusic.avi, encryption wont help. You will hand over either your 25 character top secret password or your denture. For those situations, it's a lot preferable if no suspicion arousing files are found.

For safer surfing, a VPN connection - preferably one easily going through proxies is more useful. I would stay away from solutions like Tor, because they make you suspicious by default and go with a plain vanilla corporate VPN, one preferably landing in a legitimate corporate net from where you can connect to further machines containing the stuff that can lead you in trouble (eg Pretty Woman with Julia Roberts in some parts of the world).

Guardian Project

[kensan]

Hi, check out the guardian project http://guardianproject.info/ which is aimed at mobile security for Android.

mVPN on Symbian

[phoenixlpr]

You can use Nokia's mVPN on Symbian with a VPN provider of yours.

Mobile not secure

[Anonymous Coward]

All mobile OS have backdoors for governments. Forget security on mobile.
Some Linux MAY be secure. Pick your distro carefully.
Saudi Arabia prohibits encryption use. Lots of people do it anyway, but...

Connection Encryption

[jkeelsnc]

As with some of the other posts I would be concerned about raising the eyebrows of the local intelligence agencies by encrypting a connection. In some countries (Iran for instance) i would think this would almost automatically trigger a police officer at your door for questioning or a visit to a local police station for interrogation. They would want to know what secrets you are hiding from them. I also imagine that leaving things unencrypted is undesirable as well. Personally, using "normal" channels is a mistake. Too bad there are not some affordable yet covert communications channels that have little to do with traditional phone networks or internet. Or at least something that transmits at different frequencies in small bursts that just look like background interference etc (I know CDMA works on this but that doesn't help in foreign countries and it is still in a domain that the authorities monitor from the CO, backbone, etc). I am sure the CIA has something like this. But it is about time that we had alternative paths that are covert and very difficult to even detect. In which case, it would not even have to be a really high speed connection for something like sending an email now and then or the occasional document or file. Even then, there is still risk with something like that being suspect by the local intelligence agencies if it is a device they know that you have and they become curious about something that is not simply a "normal" cell phone or small computing device. It seems best to just live with their local laws and try not to counteract them because otherwise there is a high risk of winding up in a very bad prison or similar situation and maybe no way for your own country to get you out of trouble.

Rgihy..

[Anonymous Coward]

thanks Very is Blog themes good

Solangul forum

Fuck you.

[Anonymous Coward]

Yes, yes, those evil sandniggers with their strange head gowns....

Spoken like a truly self-righteous prick from that Western country which is dismantling its citizens' rights the fastest, by far while demanding that every other Western country do the same.
I have been in Arabic countries quite often and I will return their even more often. I refuse to visit the USA.

Posting AC because I have no interest in any answers you may or may not write.

Summary of the situaton

[Anonymous Coward]

I have tried to comment multiple times on some of the advice given here.
First let me state my credentials, I live in the GCC, Actually I have lived here for the last 6 years. I have travelled extensively to GCC/MENASA/all of the stans.
You can take your mobile phone with you, it will not be taken by any customs officer. They probably have better phones than you in many of these countries.
Only exception used to be KSA, where phones with cameras were tricky. Not anymore unless you happen to be female high school student, google and you will find what i mean.
You can not use a VPN service, in most of these countries (GCC specially) is illegal, using any form of encryption in Iran is illegal. And given the big fuss with Raymond Davis, if I were American I would to brag about my technical skills in Pakistan either.
If you go to the GCC all the expats will tell you how they use a cheap VPN provider to bypass the local censorship. It is illegal. It is not enforced, but it is illegal. If they feel the need to hammer you they will use this.
Written laws are kind of a luxury in many of these places (you would be surprised) then actual enforcement is a different animal. You do nto argue the finer points of law with the enforcer here unless you want to ruin your day. Nor in the US as many photographers have discovered
You should be more concerned about other stuff, never ever give the middle finger to a local, it does not matter what they do, they can change 5 lanes without indicators, that is fine. Do not get drunk on the street. Do not kiss girls on the street. In some of these places you can do anything you wish... as long as you keep it under closed windows.
Look I do not know why my posts do nto show up, but for once it may be helpful to get a post from someone who knows what he is talking about first hand. I am not into bragging, I am posting AC because bragging here is not a smart idea.