Was about opening my second bottle of bourbon for the day, when I thought about writing a quick guide to communicating securely in Nigeria (a country that detests free speech).

It's no longer news that the Nigerian government can track you down and lock you up if you speak against them. I would like to explain how to secure your communications (but I guess this will be more useful for activists) and the methods I recommend.

The tldr is simple: Use Tor, use Signal -- unless your life depends upon them.

If your life depends upon the security of your communications, then there is no substitute for learning how these things work. Experts might also use Tor and Signal -- but not in the ways naive users would that would expose their privacy. Experts might use something else... If you wait until your life depends upon it (such as when you've suddenly decided to take up arms against the Nigerian government), then it's probably too late. The government will already have access to all the communications records up to that point.

"But EvilSec, how are you sure they have access to comm records up to that point??"
Well it's simple. The phone company keeps a record of all SMS messages and calls indefinitely. Even if both sides delete the messages or calls from their phones, all SMS messages and calls are preserved and searchable by the government and they don't even need a warrant.

Thus, you should be using privacy protecting technologies now, such as the Brave browser (when not using Tor), Signal/WhatsApp/iMessage for routine communications, and so on. Signal (and some others) use end-to-end encryption, meaning it's impossible for anybody in between to eavesdrop on your messages/call -- not even Signal itself. But this does not protect the ends. If you've been tricked into installing malware on your phone, the malware is on the "end" and thus can eavesdrop on anything that end does. Nor does it protect metadata. Eavesdroppers can't know the contents of a phonecall, but will know that you are using Signal, and will often know who it is you are calling.

Also remember that your phone is a GPS tracker. Your phone keeps a log of its own location to an accuracy of a few feet. The nearby celltowers keep records of your location with varying accuracy which can often be less than 20 feet, but is usually more like 500 feet. Your phone updates its log every few minutes, so if they get your phone from you and run forensics, they can draw map where you've been. Celltower records update much less frequently.

So stay safe out there everyone and I hope you learnt a thing or two from this.

Btw, anyone got Whiskey recommendations?

Haha some of us are not really concerned about the logs keeping as it’s bound to happen in order to efficiently have records of user data and possibly track user. Nice writeup though.

Best is to be safe and not go beyond bounds, for non-activists.

Signal saying it has end-to-end encryption, well i guess not, that’s also what Icq and Tg said before everything went out of hand as the big brothers already have their way. Just saying though.

As for the whiskey, i have no recommendation but would love to have one delivered.

Signal is pretty solid. As for "getting out of hand", I quite get your point, which is why I won't include "ToS" in my threat model. As far as I can tell, they are fiction... ToS doesn't stop them from eavesdropping on your calls/sessions, but E2EE does. No ToS ever created prevents eavesdropping.

So what type would you have delivered?

All is good so far it routes on the internet and you’re not stepping on wrong toes lol.

EvilSec:
Signal is pretty solid. As for "getting out of hand", I quite get your point, which is why I won't include "ToS" in my threat model. As far as I can tell, they are fiction... ToS doesn't stop them from eavesdropping on your calls/sessions, but E2EE does. No ToS ever created prevents eavesdropping.

So what type would you have delivered?

Any brand > 18y

Can't we build our own cell towers?
If we use SDR transceivers and satellite dishes

Hotspotbro:
Can't we build our own cell towers?
If we use SDR transceivers and satellite dishes

Nope. Well unless you want a create a fake cell tower signal that acts as an IMSI-Catcher.

Watin Una day hide

True security is just a mirage, no matter how secured a system or a communicating medium it can be hacked anytime. We can only try our best to secure our systems and online activities. That is because say God dey guide us no mean say we go open doors and windows sleep for night.

What type of security are we even talking about

Use telegram.

Telegram is becoming the dark web for all communication.

Some rando said "wetin una dey hide"
Whenever someone says they have nothing to hide, I ask them what their bank account login details are. Suddenly, they too, have secrets.

https://www.nairaland.com/6646536/nia-gets-n4.87bn-budget-track
I made this post weeks before the govt did this.
Anyone that read my post knows the govt just cashed out big again xD

EvilSec:
https://www.nairaland.com/6646536/nia-gets-n4.87bn-budget-track
I made this post weeks before the govt did this.
Anyone that read my post knows the govt just cashed out big again xD

So they now intercepting our private messages, well looking from National security aspect that’s good. They will be able to track infos and clear tracks, lol. Money goes around in the government. It’s a good idea to be part of the moving train.

Bahat:


So they now intercepting our private messages, well looking from National security aspect that’s good. They will be able to track infos and clear tracks, lol. Money goes around in the government. It’s a good idea to be part of the moving train.

They can't intercept jack sh!t man.
Normal phone calls and messages? Yes, they can intercept that.
Whatsapp calls and messages like they just claimed? Hell no.
Even WhatsApp can't decrypt the messages or sniff calls, only the ends can. That's what end-to-end means, nothing in the middle "like the government" can decrypt sh!t.

I know money goes around around in the govt and they loot alot, but 4+ billion for a non existent crap is just too much man.

EvilSec:

They can't intercept jack sh!t man.
Normal phone calls and messages? Yes, they can intercept that.
Whatsapp calls and messages like they just claimed? Hell no.
Even WhatsApp can't decrypt the messages or sniff calls, only the ends can. That's what end-to-end means, nothing in the middle "like the government" can decrypt sh!t.

I know money goes around around in the govt and they loot alot, but a 4+ billion for a non existent crap is just too much man.

That’s the problem we have in this country of ours

EvilSec:
Signal is pretty solid. As for "getting out of hand", I quite get your point, which is why I won't include "ToS" in my threat model. As far as I can tell, they are fiction... ToS doesn't stop them from eavesdropping on your calls/sessions, but E2EE does. No ToS ever created prevents eavesdropping.

So what type would you have delivered?

Hope you know it is possible for unscrupulous people to clone your sim on another network, call your associate and get all you discuss, they can even have access to your bank account. This is the new Phone in the middle attack, or Phone compromise attack. So if you think your whatsapp is save you go to bed by 9pm to wake by 6am, by that time they had received call from whatsapp about your verification code, chat your associate up and offer them alternative numbers to communicate with. This attacks are real, I have people attacking my number all the time, if I switch the line off, it doesn't say switch off on the other end, it say not available but call is been transfer, depending on the network I use to call. So it seemly tells me the line is sleeping on two network. They can also create a new bank account using your ID without you ever been aware. They wey too many banks and micro finance banks in Nigeria to want to track all.

Someone needs to tell Seun that the anti-spam bot is being too aggressive.

EvilSec:
Someone needs to tell Seun that the anti-spam bot is being too aggressive.

I couldn’t believe when i saw my question deleted. Like who tf does that.

And i notice why is our info live unhashed on the wire!!! Really don’t know why. Is there a better reason for this?

Bahat:


I couldn’t believe when i saw my question deleted. Like who tf does that.

And i notice why is our info live unhashed on the wire!!! Really don’t know why. Is there a better reason for this?

what sort of info?

EvilSec:


what sort of info?

Back to my deleted question. Do any one of us here know how to go about the sim card porting locally here. Method or whatever you may call it. Well it’s just to know about how the attack take place and ways to circumvent the situation individually

Bahat:


Back to my deleted question. Do any one of us here know how to go about the sim card porting locally here. Method or whatever you may call it. Well it’s just to know about how the attack take place and ways to circumvent the situation individually

I'm sure jackcanfield can further explain the entire thing in details