gMan VMulciber
I’ve looked into Cape, but I don’t find it compelling in many cases if you’re already taking certain measures.
What Cape does give you:
• Enhanced Signalling Protection – unspecified additional policy restrictions on SS7/Diameter routing, optional location from Cape app to match real (general) location to signalling to alert on potential routing attacks, and a SOC looking for suspicious routing requests. This can protect against obvious carrier-level malicious routing requests to intercept calls and SMS.
• SIM Swap / Port Out Protection – a cryptographic signature is required to assign a new SIM to your account or to move your phone number to a different carrier, preventing someone from using social engineering to take control of your number (and all of the 2FA access that comes with it).
• Identifier Rotation – changes IMSI daily. This is normally a long-lived identifier that a Radio Access Network (RAN) operator uses to authenticate a customer to their carrier for authorization and billing. IMEI rotation is also available to Cape Obscura customers.
• Encrypted Voicemail – as a new voicemail is delivered to your inbox managed by Cape, they encrypt it with your public key, so that only your private key in the Cape app can decrypt and listen to the message.
• Private Payment – Cape only stores an anonymized token to match payment status to your account, so Cape doesn’t know your name, address, or full card number. Stripe stores that info.
• Others – Cape claims minimal data collection. Their infrastructure is all cloud-based, so it’s more likely that they maintain up-to-date software versions with the accompanying security patches. Also with it being new infrastructure, they likely had little “technical debt” and could start fresh with secure-by-design principles.
With that being said, those features can fall a little (or a lot) short:
• Signalling Protection – an attempt to reroute SS7/Diameter traffic to a different continent or even country would probably be pretty obvious, but many actors abuse nodes within the target’s country, so I’m not sure how useful these unspecified policy and monitoring protections would actually be. This also doesn’t protect against legal demands (whether legitimate or abused).
• Persistent Identifiers – while IMSI rotation is available to all customers (on supported phones), IMEI rotation is only accessible to Obscura customers after an invite, likely some sort of identity verification, and only using their provided phone and OS. Mobile versions (e.g. 3G, 4G, etc.) add new privacy features (like TMSI/GUTI, 5G SA’s SUCI), but are mostly focused on passive listeners over radio, not the cell towers and their operators. Cape runs their own core network, but relies on US Cellular and other roaming partners for the actual connection. These Radio Access Network (RAN) operators can not only see the IMSI, but also the IMEI. This makes the IMSI rotation almost useless because without Obscura, the IMEI persists for the life of that phone across all OS installs and SIM changes. Just as bad or worse, even with IMEI and IMSI rotation, the RAN operator’s serving network likely can and does request the MSISDN (phone number) – so unless you change your phone number at the same time and every time you do the IMSI and IMEI, you’re likely not doing much. Also, one could argue that using Cape could make you stand out even more, as it's intended for people who think they're high-threat, but this is more speculative.
• Tower Location Data to Data Brokers – Cape’s privacy policy points out that “physical infrastructure operators” (e.g. RAN operators) do collect precise real-time location data (from techniques like TOA/AOA/OTDOA/E-CID). This is the kind of data that carriers sell to data brokers that advertisers, foreign governments, and law enforcement (even against Supreme Court rulings) regularly access and use. There’s no opt-out and it's out of Cape's control. Combined with the persistent identifiers described above, this could render the most important aspects of some peoples’ threat models almost completely unprotected. Even if your name isn’t known by Cape, adversaries are likely to conduct discovery starting from a geofence (for instance around a sensitive government site, protest, or crime scene) and work backwards from there (geolocation of where you live and work, other commercial data tied to your phone number, etc.).
• Encrypted Voicemail – much like ProtonMail and Tutanota (for external emails), you’re expecting a provider to receive plaintext and encrypt it using your and only your public key, and then delete the unencrypted plaintext. This could theoretically fail under a malicious provider (Cape), an external breach of the provider, or a legal preservation order. This is an inherent flaw in the model though with no clear fix.
• Private Payment – although Cape doesn’t store your name, address, and payment method, Stripe does. That token identifier can link your Cape account to your identity if either Cape maliciously saves that linkage, Stripe is compromised (hack or data dump), or legal process is issued to both providers.
• Data Collection – even if Cape does collect minimal data, some of the most threatening data collection, as previously explained, is done at the radio/servicing network layer, outside of Cape's control. This is also in addition to app and web-based data collection as part of the much larger ecosystem.
• The Other Party – Cape’s core routing protections, encrypted voicemail, and identifier rotation don’t protect you from the weaknesses in the other communicant’s provider. For instance, even with daily IMEI/IMSI rotation, if there’s someone you frequently call or text, they can be targeted. This would allow interception of their calls and voicemails to you, as well as make it easy to learn your MSISDN, IMSI, and possibly IMEI (which could then be further queried), even with the regular rotation.
Note on threat model:
• Some of Cape’s protections do raise the bar on an adversary to some degree in comparison to a “normal” carrier and phone. Specifically for the US though, the sheer availability of raw carrier data in combination with other data from our surveillance capitalist system really weakens those benefits. If that wasn’t bad enough, when our hybrid authoritarian regime is willing to take targeted efforts, like the revocation of a Green Card without due process by the Secretary of State personally, then other legal overrides, like the possibility of the Attorney General or even a designee authorizing and demanding NSA to use a top-tier capability reserved for foreign adversaries against a US-based dissident, are easily within the realm of possibility. Especially since this action is substantially less likely to be made public and/or challenged in court unlike the Green Card revocations. Additionally, while some of the technical correlation may require more manual analysis, much of federal law enforcement and intelligence workers have been reassigned from legitimate duties (investigating violent crime, political corruption, right-wing domestic terrorism, counter-intelligence, counter-foreign influence) to assisting ICE in their terror campaign, in addition to ICE’s ballooning budget and internal manpower. That’s not to mention the possibility of increased automation and correlation abilities in quasi-government and contractor entities, like DOGE and Palantir. In short, there have always been robust technical capabilities in the hands of authorities, but I think it's pretty evident that the guardrails to limit misuse are broken or completely gone. Combine that with the accessibility of ad tech data and mercenary spyware to a swath of countries and I think you'll see a very different threat landscape from a few decades ago or even more recent.
Possible remediation:
• Persistent identifiers – this one is difficult because remediations are more OPSEC than technical capabilities. Considering the threat, the best thing to do is not make your identifiers stand out. This could be leaving your phone on, but leaving it behind during a sensitive activity (searching for phones turned off before a specific event, even in a large geofence, is a big investigative lead commonly followed). Incorrect subscriber info can be given as well, as my initial setup points out, to protect against an adversary searching for your name in a compromised carrier or data leak. Anonymous payment for major carriers is also described. Turning on cellular downgrade protection can keep a less capable IMSI-catcher/stingray from getting your identifiers, but likely not more advanced ones. Using a data-only eSIM might remove the ability to identify the persistent MSISDN, but there are likely other persistent identifiers besides IMSI and IMEI that could be used the same way anyway.
• Tower Location and Data Brokers – don’t have your phone in a place/time you don’t want to be tied to. Use a VPN if you don’t want your browsing history sold. Opt out of whatever options you do have in your account portal in case it actually does anything.
• Encrypted Voicemail – just use Signal or another E2EE app. Seriously. You just can’t make carrier calls and text anywhere near as secure. Verify Signal contacts to prevent against possible key directory manipulation for MiTM.
• SIM Swap / Port Out Protection - some major carriers now offer similar options, even free of charge for pre-paid plans. Some have the option to require you to log back into your account portal and disable the setting before a SIM can be changed or your number ported out. Some carriers allow you to require a Passkey/WebAuthn-based with no insecure fallback/recovery method. While Cape's method is more directly tied to a cryptographic key, it can still be overridden on the back end, like as they explain for legal demands. Without knowing all of the exact details, this is close enough to the major carrier(s) I described for me. For the communication channel itself, again, use Signal and set a complex registration lock and account passphrase.
• Private Payment – using pre-paid top up cards for your cellular carrier can provide more anonymity than Cape (if you buy it with cash). Privacy.com is more convenient and is likely on par with Cape+Stripe. JMP.chat takes XMR.
• Other Party – just use Signal, turn on call relaying and sealed sender if you're worried about correlation at the IP mobile data layer.
Again, I don’t think Cape are grifters, snake oil, or a honeypot. I think they’re pretty transparent about what they do and its limitations (even if it’s on their technical blog and not their marketing homepage). I appreciate their support for GOS and other privacy-focused projects. I just think what they’re doing is an uphill battle that can be mitigated in other ways for many use cases. The real target audience (whether intended or unintended) seems to be military commanders who want to call the duty line and don't have a STE around, politicians trying to make back-room deals but can't get all those geriatrics onto Signal, and CEOs/trust fund kids with megalomania out the ass that want to feel important and more protected than us commoners.