Spending a lazy sunday afternoon testing faraday bags for phones. (Preliminary results so far: You don’t always get what you pay for, but you never get what you don’t pay for.)
Motivated by the fact that iPhones officially can’t be powered off, which, even if they implement really good privacy protections, will inspire other manufacturers to try similar things, often less carefully.
Some quick preliminary results, testing at 1, 2, 3, 4 , 5 and 6GHz: The expensive (~USD 40-60) phone-size bags from Mission Darkness (sold on Amazon) and EDEC (online store) work reliably well: >60dB attenuation at 1M distance, IF closed properly.
Recycled ziplock mylar antistatic bag: < 8dB attenuation. Cheap RFID blocking bag: ~9-12 dB. Metal biscotti tin: ~6dB, worst performance, but provided snaks during testing.
The pricy bags worked pretty well, if you can stomach the “tactical” design and marketing. 60dB was a lower bound limited by the fact that the local RF noise floor prevented more sensitive measurements. Will redo in an RF test chamber when I get a chance.
As a practical test, the pricy commercial bags all prevented detection/activation of an Apple AirTag within 6 inches of a phone, while the mylar bag, RFID-block bag, and biscotti tin failed to prevent detection from anywhere in the room.
Some caveats: I just tested one or two phone-size bags, not the complete line of products from each vendor. Sealing the flap is absolutely critical. The bags seem somewhat brittle, and probably susceptible to damage if folded or handled aggressively.
Basically, 60dB attenuation is sufficient to give me reasonable confidence that a low power device (such as Bluetooth) in those frequency ranges won’t be detectable at moderately close range.
Can you make something for less money than the commercial ones? Probably, but the problem is that properly testing it to give you assurance it works involves a ton of expensive gear. And then there’s the problem of being sure it stays working after your’e done testing.
OK, some more results on the commercial faraday bags, this time inside a shielded RF test chamber. The Mission Darkness and EDEC bags were quite similar, > ~100 dB at 1 and 3 GHz, ~90 dB at 4 and 5 GHz and ~85 dB at 6GHz.
That’s pretty damn good. The two brands were quite similar, with about +/- 10dB variation in the measurements depending on how well I folded the velcro closure. More than sufficient for attenuation for almost any signal coming from a device that you could fit in the bag.
For these tests I used a small R&S RF test chamber (intended for testing cellphones), hooked up to an R&S PR100 measurement receiver. For the signal source I used a cheap RF Explorer signal generator with a short wire antenna, which just fit inside the bags under test.
What about assuring that signals from OUTSIDE the bag can’t be received? That’s harder in general, since an external transmitter might be arbitrarily high power and in close proximity. But ~90dB is still a LOT of attenuation in practice for any reasonably distant signal source.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Radio nerditry: Yes, I've heard that KrakenRF pulled their passive radar code, and no, I'm not looking forward to revisiting ITAR after all these years.
There isn't, as far as I can tell, enough publicly-known information about the facts here to even speculate about whether this is an easily-resolved misunderstanding, over-caution, or a serious concern. I can imagine ways it could be any of the three. Hopefully not the latter.
Cryptography in the US, even open source software, used to be (and to a limited extent, still is) regulated under ITAR. It was a big attenuator on open research. But because different countries interpreted ITAR for cryptography differently, it wasn't as bad as it could be here.
Unpopular and uncomfortable election integrity reality: While BS about "hacked elections" has been most loudly amplified by the Right in the US, they have no monopoly on it. This nonsense was mostly started by (and continues to be spread by) marginal activists on the Left.
Two difficult-to-reconcile truths about US election integrity. Any serious discussion of the subject must acknowledge both of them:
- There genuinely are some real vulnerabilities in some of our election infrastructure
- There's no evidence an election outcome has been hacked.
Whatever your political preferences, asserting than an election as been hacked is an EXTRAORDINARY claim, requiring compelling evidence. If someone makes such a claim, demand evidence.
The remedy for BS is truth, not equal-and-opposite BS.
Even if it taxes your patience, being careful and following procedures in tallying votes is not evidence of fraud. In fact, it's the opposite of that.
"Isn't it suspicious that it's only tight races that are undecided?"
No. That's exactly what we'd expect.
Any "winners" reported so far are media projections from partial tallies released so far. The closer the race, the higher the % of votes cast they need to project a winner.
Very few jurisdictions across the US have reported 100% tallies in any races yet, and even those are still unofficial, uncertified results. State laws can delay full results until well after election day; in some, mail-in votes can't start to be processed until after polls close.
Any Twitter engineer being asked to certify compliance to a regulatory agency (such as the FTC) should seek independent (their own) legal advice before signing anything or making any statement to regulators.
This is a bus you do NOT want to be thrown under.
I can't emphasize how perilous this can be. "Self-certification of compliance" with an FTC consent decree might be presented as merely routine paperwork, no big deal.
No. It's a big deal, and if you're even thinking about agreeing to this, you need competent legal advice first.
As election results start to come in this week, some losing candidates and supporters may claim that their election was "rigged" or "hacked". To sort fact from fiction, you have to understand how elections actually work. Here's a great reference: nap.nationalacademies.org/catalog/25120/…
A large fraction of “stop the steal” mis- and disinformation was OBVIOUS BS to those who understood the basics of election logistics, and tech. But it could sound convincing to the uninitiated. Learn how your local elections work, especially how ballots are handled and counted.
And many aspects of elections vary across states and counties. For example, in some places, for procedural and technical reasons, mail-in ballots aren’t processed until AFTER the polls close. If the number of those ballots is large, it can take a while before results are known.
I've been using Mastodon for a couple days now. A couple (nonexpert) observations
The system as a whole functions. The major servers (that you're likely to sign up for) federate with each other, which means you can, in principle, follow and be followed just about anywhere. 1/
However, the system is clearly (and unsurprisingly) also straining under the newfound load right.
Many servers are closed to new signups, so you have to look for one that will take you, which may not be where most of your friends are. That's OK (see above), except that... 2/
... likely because of the load, timelines across different server instances are often a bit of a mess - out of order, slow to update, duplicate posts, etc. So it doesn't always feel like Twitter. Sometimes more like Twitter if the tweets were delivered by actual carrier pigeons.