Rise of creepyware

You don't need to know me

It seems to be a trend all around the web and software world that they want to know you. And if not directly you, at least they want to know what is your phone number - and that is same thing for me than wanting to know me. This is what I call creepyware.

Many years we have have this trend that we need to give our email address to whatever sofware and web site logins. It is annoying and it is almost as bad as giving phone number, but still not as bad. It is bad for normies in that sense that many of them does not know at all that there is possibility to use temporary email services or have multiple email addresses which in the end lead to the same user.

In email registrations users still can create very anynomous email address tho, like captainjacksparrow@whateverdomain.com which probably is not easily pinned to you - unless of course you are Jack Sparrow and you are the captain. Then you can create another kind of email address.

In many cases email can be traced to user behind it if somebody really wants and if they have enough power (like FBI). If you use Gmail, Outlook or whatever commercial email provider there is a big change that you have used your credit card or phone number in registration or at least on some point what can be linked to you. Then it is game over. Of course if the FBI is the one who wants to find you, they will get logs from Google anyway and they quite probably have IP addresses stored where you have logged in your email and then they can find you Internet Service Provider and ask your information and find you.

I think that is still the case what average person ever needs to worry about since normal persons do not do crimes in web and therefore FBI is not that keen to spend time, energy and resources to figure out who is writing on the internet who has registered somewhere with Gmail account.

Much bigger issue is the phone number. You can generate temporary emails thousands and thousands quite easily if you just want to, but with SMS it is not the case. You normally have only one to five different phone numbers and you are not going to get new phone numbers just for new services. Also those numbers should be prepaid anyway if you really want to stay quite anonymous. That SIM card should be saved to new phone what IMEI is not yet known in network either so the link between you and SIM card and phone is not that easily connect.

That is also something what is not really realistic to care about. Yes, if you are paranoid then that might be the case, but in normal person normal life that is not something to worry about anyway.

Then what is the problem

At this moment most realistic problem is advertisement and how they will collect all the data possible about you. Also another issue is hacking cases when all the stored phone numbers are stolen and then somebody founds them and uses those to do whatever they want to do. The more services you need to use your phone number to register, the more information about you can be linked togeter.

The more information about you is collected then it is possible to build better profiles about you. If that is used only for advertisement purposes then it is just morally wrong and annoying as heck, but still that is not in most of cases dangerous, or at least that is what I currently think.

But think about the future - what if there will be a law that all the web services must be logged in using services what is using "strong authentication method" - 2FA what is in your phone or directly via SMS. Then everything you do in internet can be traced to you since SMS is quite often linked to person directly and that can lead to very dangerous path to the dark era of humankind.

What if government starts to force all services that they need to share information of their users (phone number is enough) directly to government? Then all the services where you have been can be linked more easily together.

For example if some people do stupid stuff and they have used sites X and Y then it is easier and easier for governments to create more dangerous surveillance system where all other users who uses X and Y sites are viewed as potential threat to society and then they are spied much more even they have not done anything wrong neither they have any intentions to do anything morally or legally wrong.

Or what about if all that collected data is leaked? Then it can lead to disasterous results for many people, even if the have not done anything illegal.

For example, think about the case if someone is a Christian and she is registered for Christian web forum. That site asks phone number and she gives it to the site. Then later she wants to go to another country where christianity is prohibited by law. When she applies for a passport they can search by phone number all the sites where she has registered and then they will find out that she is a Christian and therefore they will decline her passport because of her login to Christian web forum, or at least they might start asking lots of questions about her registration to this kind of forum.

Of course that is just a dystopian nightmare and only a possible outcome what could happen in future, but the more services asks and collects your phone number the more easily it is to link to the user. Now only by advertisement people perhaps, but it just a matter of changing the law and then all the information about you is forced to give to the government. Then they have great amount of information about you, your habits, your interests and your usage of social media as well as your ways of communication.

If you are person who is keen about privacy and have used Signal, then it can be seen as a potential threat by dystopian government. I mean, who wants to use privacy focused communication tool unless they have something to hide ;)

Everything is creepyware if you ask phone number

So shortly, every service and every app what asks you to give your phone number is a creepyware. They might have encryption and they might store your data privately, but then there is already metadata collected what can be traced back to you and therefore it does not matter much if they have encryption or not - they have already collected too much information about you anyway.

I personally rather trust unencrypted anonymous chats (IRC) where I can connect from wherever I want and do not need to tell anything about me if I do not want than those services what are encrypted but still linked directly to me. I can go and buy server with crypto and go there over SSH and then from that server connect to IRC and that way I can stay anonymous.

If my communication is unencrypted, it does not matter that much - nobody knows anyway who I am and where I am writing my lines and that is why anonymity matters much more.