How damning is setting up new phone on home internet?

FishTank444

In retrospect I'm afraid I've leaked, at least partially, my identity by going through the initial Google setup for a brand new phone in order to then install Graphene using my household's network. I did not use any email or give over any information telling the phone who I am. My concern is that this hardware's identifiers were revealed to belong to someone of that household and then when purchasing a prepaid sim card that the cell provider would see that association and I would be de-anonymized.

JollyRancher

FishTank444
Does your threat model consider law enforcement or the government as an actively hostile actor?

If yes then the device may well be compromised. Drive to another city, park and leave your phone in the car, use public transit to travel to an electronics store, buy a new pixel with cash while wearing a covid mask, if in the us buy a few Mint Mobile trial cards, buy a dirt cheap android phone and a usb-c to usb-c cable. Walk outside, load one of the Sims into the cheap phone, load the other into the pixel. Update the pixel, remove its sim, then use the cheap phone to flash GOS onto the pixel. Dispose of the Sims and cheap phone. Put the pixel in Airplane mode (and ideally in a Faraday bag). Return home. Wait 3 to 6 months to touch the Pixel again.

Go to a public location and use WiFi to update the phone and install Mullvad as the always on VPN.

So long as you kill all connections outside the VPN you should be fine on home WiFi assuming that your home WiFi isn't already being targeted.

If your threat model doesn't have state actors as your opposition then you are basically fine.

DeletedUser69

JollyRancher I would say vast majority will settle with that last sentence.

FishTank444

DeletedUser69 As will I.

As far as network traffic is concerned, I'm not overly concerned, using an always on VPN. The bigger thing is the association between the new pixel process of connecting to internet to unlock the phone and installing graphene both using the home network. If Google's process did not leak hardware identifiers then I'd feel (perhaps naively) confident that I could use a prepaid sim and retain anonymity when connected via cell. Again, network traffic would be protected through the VPN but location would not when connected to the towers and that is the biggest thing I want to avoid: a cell provider having my location history.

JollyRancher

FishTank444
If you want to avoid cell tower location history then no Sim and Airplane Mode always on.

There is no way to conceal what towers your Sim is connecting to from the telecom and that is enough for roughly city block sized location tracking (potentially much more precise depending on the environment).

If you put a Sim in your phone then the telecom will have the IMEI number and GOS doesn't support modifying that.

One possibility is to have multiple GOS phones that are used as hot spots for your regular phone. When you need a new ID for the telecom you burn the hot spot phone and replace it with a new one.

de0u

FishTank444 That is the biggest thing I want to avoid: a cell provider having my location history.

Cellular carriers are required to track devices -- in part because of legal mandates related to emergency calls. Thus cellular networks are designed to track devices.

Using a cellular network without being tracked is like flying without going up.

DeletedUser64

FishTank444 the biggest thing I want to avoid: a cell provider having my location history

Don't use a mobile/ cell phone, communicate on a cheap refurb laptop and free WiFi from where ever you find it. Bin the laptop every once in a while and get another, rinse and repeat...

DeletedUser84

FishTank444 biggest thing I want to avoid: a cell provider having my location history.

Simple. Use aeroplane mode 24/7 (or as much as you can).

rellhom

JollyRancher If you want to avoid cell tower location history then no Sim and Airplane Mode always on.

there is never any cell tower pinging in this situation no matter what?

FishTank444

de0u

Cellular carriers are required to track devices -- in part because of legal mandates related to emergency calls. Thus cellular networks are designed to track devices.

100% agreed. However a cell carrier tracking a phone bought anonymously and a sim card bought anonymously doesn't necessarily go back to the person despite it doing its job in tracking the device. I'm afraid that the identity was leaked when the home WiFi was used to unlock the brand new device and install graphene onto it.

FishTank444

Sorry, I don't think I can edit my previous reply. Here's the edit of it.
de0u

Cellular carriers are required to track devices -- in part because of legal mandates related to emergency calls. Thus cellular networks are designed to track devices.

100% agreed. However a cell carrier tracking a phone bought anonymously and a sim card bought anonymously doesn't necessarily go back to the person despite it doing its job in tracking the device.

Consider the hypothetical situation I see (which may be straight up wrong but I'm trying to understand how this process works)

Phone purchased in cash
Phone requires network connection to unlock for graphene installation, this is performed on home network
Install graphene
SIM purchased in cash
Use sim away from home

If on step 2, that initialization process with stock android tells the ISP the phone's unique identifiers then when using the anonymous sim in step 5, the cell provider could potentially be aware that the hardware being used was associated with the household in step 2. Then it would be pretty easy to infer which member of the household based on usage patterns or device associations or whatever else could be used to track a device / person.

Maybe the network connections are never revealed by the ISP and this ends up being a non-issue but I'm not an expert in this field and again, I'm just trying to understand how it works so that I can make better decisions for myself and help inform others down the line.

stopthefeds

FishTank444

On step 2 I don't think the issue is telling the isp but rather potentially telling Google.

If Google sends hardware identifiers (IMEI, S/N etc) to its servers during initial setup, then those identifiers are linked to your home IP.

And assuming your threat model includes Google giving up that information to authorities, then you could be deannonymized.

de0u

FishTank444 Consider the hypothetical situation I see (which may be straight up wrong but I'm trying to understand how this process works)

Phone purchased in cash

Phone requires network connection to unlock for graphene installation, this is performed on home network

Install graphene

SIM purchased in cash

Use sim away from home

If on step 2, that initialization process with stock android tells the ISP the phone's unique identifiers then when using the anonymous sim in step 5, the cell provider could potentially be aware that the hardware being used was associated with the household in step 2.

OEM-unlocking the phone shares the IMEI with Google, not with your ISP (unless Google Fiber is your ISP). Using the phone on your home network without a VPN leaks information to your ISP, not to your cellular carrier (unless your ISP is Comcast and your cellular carrier is Xfinity Mobile, etc.). There isn't a single giant "They" that is integrating all information about you.

Or, if there is a single integrated "They", then OEM-unlocking a Pixel on a public network isn't the one critical step that will stop "Them" from stirring together all of the other data.

JollyRancher

Every time a phone connects to a tower is a data point. Even with an anonymously purchased phone and Sim card you will be rapidly IDed if you daily drive it.

The phone would consistently spend time at specific locations which can be used to ID you. For example, let's say that you get pinned on the highway at a certain date, time, and location. All the government has to do is get the traffic camera records for that location at the correct time and they have narrowed who you could be from a very large group down to a very small one.

Then they pull the records for those same towers at that time and correlate those with the other vehicles.

Hiding from cell tower tracking is essentially impossible with a Sim.

The best you can do is multiple phones used as hot spots. Each only used in line with a given profile before being stored in airplane mode and replaced regular (except the one you want "publicly" linked to you).

FishTank444

de0u There isn't a single giant "They" that is integrating all information about you.

The way you explained things clarifies, thank you. The lack of transparency into this system makes it difficult to clearly see how connected or not things are.

de0u

FishTank444 To be clear, if law enforcement comes after you, they become an integrated "They". In the U.S., geofenced warrants are a big issue.

And if/when carriers sell location data wholesale, that is a big issue.

But the high-value data stream is regular cellular tracking. It's not clear what is gained by concealing just your IMEI from just Google for the vast majority of people (especially people who share location data with Google via Maps, Waze, and/or Google's Wi-Fi-based location service).