Global untraceable phone calls - is it still a good idea?

[limikael]

Hello people!

Way back in the day (2014) I created a site called chiliphone.com. I announced it here on the forum as well, in this post: https://bitcointalk.org/index.php?topic=757391, and a bit later it stirred up some discussion in this post: https://bitcointalk.org/index.php?topic=911228.

At the time I didn't think of it as anything but an experiment. After that second post and the article I started to see some traffic though, and it started generating a small but steady stream of deposits. I got a bit scared and stressed out at this point, because I didn't fully trust my underlying tech and program. I took it offline with the intention of refactoring it, and never ended up putting it back up.

So I want to ask you guys if you think this still would be a useful service? I have looked around a bit, and can't really find another site that provides the same service. Is it worth spending time on getting it back up?

To explain very quickly how it worked:

1. Pay some bitcoin to an address (or in this day and age, why not lightning network).
2. Cal any international phone number using WebRTC directly from your browser.

[1714776085]

1714776085

[1714776085]

1714776085

[dkbit98]

So I want to ask you guys if you think this still would be a useful service? I have looked around a bit, and can't really find another site that provides the same service. Is it worth spending time on getting it back up?

I think it's well worth spending time on this, but you need to provide some proof that this is really untraceable phone calls and not something to collect information and spy on people.
It all depends how much I would have to pay per minute, but I would use it for some reasonable price.
Problem is that this could be used for some illegal stuff, so it would certainly get attention from regulators and law enforcement at some point.

1. Pay some bitcoin to an address (or in this day and age, why not lightning network).

I would use both Bitcoin and Lightning Network payments, second would be better for privacy in my opinion.

2. Cal any international phone number using WebRTC directly from your browser.

What phone number would they get on their caller ID when I call them like this?

[hugeblack]

If you mean about the technical aspects related to accepting payments with Bitcoin or using the Lightning Network, then BTCpayserver^[1] made all these things possible with zero fees and no need for that technical knowledge, so I don't think you will face a problem in this regard.

As for WebRTC as a service, I do not expect to get a high return here, but it will be good if you consider it a side project and may cover your basic costs with some profits.

Generally, you can try it. It's something new, but if you can provide a service to call/text to/from regular phone numbers or rent them, you will find more interest.

[1] https://btcpayserver.org/

[Welsh]

Also, worth considering is the legality of this wherever you live or are hosting this service. Wouldn't want you to land up in trouble, simply because you didn't get some legal advice. If it's legal in your jurisdiction, then I say this could be a decent service for those that want to keep their privacy. Although, the only issue is you'll likely have a lot of malicious users using the service, which could potentially cause some issues for you. Just something to think about.

Phone calls are a pretty niche department. I'll echo what has said above SMS numbers that you can use, would have far more use.

[buwaytress]

Agree with hugeblack, you probably don't need to market a product that makes untraceable phone calls -- never mind proving that it can't be traced (I think it's not true), but if the authorities chase a person who happens to have used your product, you'll not want to deal with that headache.

But if your product just allows anyone anywhere to make a phone call, leave messages (and collect texts/voice?) from the browser without using a phone? Now that I'd pay myself. Countless situations where I needed to make a call or leave a message when roaming's not working or simply not possible with bad signals.

And that means it's a viable business.

[The Cryptovator]

Isn't something like Voice Over Internet Portal (VOIP) services? A lot of service provider like this are on the market where number isn't traceable normally. This means the call will be from random numbers or from unknown numbers. If VOIP is traceable calls then I don't know how will you avoid it. Or anything special there how it will be untraceable? I think you will need legal permission to provide this service which would make it traceable.

[Welsh]

Isn't something like Voice Over Internet Portal (VOIP) services? A lot of service provider like this are on the market where number isn't traceable normally. This means the call will be from random numbers or from unknown numbers. If VOIP is traceable calls then I don't know how will you avoid it. Or anything special there how it will be untraceable? I think you will need legal permission to provide this service which would make it traceable.

Aye, but don't those services collect information on you? By either requiring Know Your Customer (KYC) information on you or by cross referencing from the data collection honey pot. Even sim cards that you buy online now need to be registered to an address, and while at the moment I do believe you can buy sim cards at a store without KYC, in certain countries they've even began to require that.

So, I can see the appeal for a service like this, but as time goes on it's likely to be considered a illegal operation, especially as times become more constrictive with KYC.

[dkbit98]

Isn't something like Voice Over Internet Portal (VOIP) services? A lot of service provider like this are on the market where number isn't traceable normally. This means the call will be from random numbers or from unknown numbers. If VOIP is traceable calls then I don't know how will you avoid it. Or anything special there how it will be untraceable? I think you will need legal permission to provide this service which would make it traceable.

Viber is example of service like this and they are offering paid service for calling any number you want, that is actually cheaper than using regular landline or mobile phone.
I would like to see something similar that would respect privacy and won't spy on it's users, and I think this service would have very big use case, not only for criminals.
Maybe some extension could be created that could work on top of XMPP protocol (Conversations app, etc), that would enable calling all phone numbers.
This is just my imagination going wild

[NotATether]

Well, if you're going to make them untraceable, you have better had already figured out from who you're making them untraceable to.

If from the telecommunication companies, you're pretty safe. But from governments handing over subpoenas to the telecoms for data? Less so. Don't make your service another Encrochat, have a TOS that prohibits and bans illegal use of the service (this can be accomplished by keeping temporary logs of the phone calls) so that you stay on the good side of the law.

[examplens]

2. Cal any international phone number using WebRTC directly from your browser.

If we talk about anything untraceable, can we even put in the same sentence "untraceable" and any "Google service"?. In this case WebRTC.

IMO phone call is too specific and personally it's not very interesting service. But if you were to offer virtual number (send/receive call and SMS) with good privacy policy, i would find it's interesting.

It's enough to receive only one SMS to activate Telegram acc, and voila.

[dkbit98]

If from the telecommunication companies, you're pretty safe. But from governments handing over subpoenas to the telecoms for data? Less so. Don't make your service another Encrochat, have a TOS that prohibits and bans illegal use of the service (this can be accomplished by keeping temporary logs of the phone calls) so that you stay on the good side of the law.

I don't know if you knew this, but most of the things like Encrochat or Sky phones are actually created by government agencies for spying on people.

It's enough to receive only one SMS to activate Telegram acc, and voila.

Everything in telegram is unencrypted and stored on their servers, including calls, public chats and private messages, except maybe secret messages that have some obscure encryption claims.
This is all connected with your IP address and mobile phone number you used for registration, so there is nothing private or secure about telegram.

[limikael]

Thanks guys for all the feedback! Will not answer to all the posts individually because that would make the thread quite messy. Will summarize my take aways and conclusion.

Regarding untraceability. I will rely on an external SIP trunk to connect to the telephone network, and only god knows what the telco in charge of that SIP trunk wants to do with the traffic. The point was not to make it super-private. It is more untraceable in the same way as good old burner phones that you buy for cash. I.e., the phone call will not be more private, but at least the way you pay for the phone call will be. I would imagine that a WhatsApp call is more private, but with WhatsApp you can't call the regular phone network. I don't have any special measure or secret sauce to make it more untraceable than that. Also, I will not store any information about anything, but you will have to take my word for it, there is no way I can prove that I won't.

Anyway, my key selling point was not really the untraceability part, it is more an "extra" feature. The initial idea is really to scratch my own itch. The main use case, i.e. the itch to scratch is more like the following. I'm a digital nomad, and sometimes I have to call my bank, insurance company, embassy, tax man, or some something other government related back in my home country. If I just buy a local SIM card, it will be expensive. I could of course use Skype or Viber and pay with a credit card, but the process of downloading, signing up and jumping to all kinds of hoops just to make a phone call with those services is quite a hassle. It would be more convenient to just make a Bitcoin or Lightning payment here.

So I think I will tone down the "untraceability" in my marketing, and just call it a service to quickly make phone calls in the browser and pay with crypto.

Yep maybe in the future I can add the possibility to receive calls too, and to send and receive SMS. But just have to start somewhere first...

Related to technical aspects I'm planning to use Electrum running as a daemon. The reason why is that in this case I don't need to download the whole blockchain. I think that with BTCpayserver I do. Please correct me if I'm wrong, and also let me know if there are any specific reasons why BTCpayserver would be better than Electrum.

Alright, will continue to hack on it for a bit, and post an update when I have something to show...

[Kakmakr]

The thing is.... can you live with yourself, if someone used your service for criminal activities. (That was the reason why one of the biggest Mixer operators closed their site)

Imagine some Pedophile using your service to groom a child and then ultimately ending up in him/her raping or murdering that child? (Will the authorities come after you, if something like that happens and will your ToS stand up in court?)

Scenario #2 : Imagine if a terrorist organization used your service to plan a terrorist attack like 911. The 3Letter agencies will come down on you with the full force of the law.

It is fine, if you create a service like this for yourself and some people that you know, but when it is public.... things become a lot more complex. 

[dkbit98]

So I think I will tone down the "untraceability" in my marketing, and just call it a service to quickly make phone calls in the browser and pay with crypto.

I think this is a good idea to remove untraceable wording, but you have to make it super easy to use for average users... it's not really that hard to install and use viber.
So when I call someone using your service is my phone number identification going to be the same each time, or this would change with each call?
I guess that receiving call probably means there would be a dedicated phone number.

Alright, will continue to hack on it for a bit, and post an update when I have something to show...

When you have some early beta version ready post it here for testing.

[limikael]

The thing is.... can you live with yourself, if someone used your service for criminal activities. (That was the reason why one of the biggest Mixer operators closed their site)

Imagine some Pedophile using your service to groom a child and then ultimately ending up in him/her raping or murdering that child? (Will the authorities come after you, if something like that happens and will your ToS stand up in court?)

Scenario #2 : Imagine if a terrorist organization used your service to plan a terrorist attack like 911. The 3Letter agencies will come down on you with the full force of the law.

It is fine, if you create a service like this for yourself and some people that you know, but when it is public.... things become a lot more complex. 

Well if something like that happened it would of course be very tragic. However I think that allowing people to communicate in general leads to a safer and more prosperous world (thereby combating both crime and terrorism). I would be happy to stand up for this opinion, it is not like I'm selling guns, drugs or organising or promoting gambling...

[limikael]

When you have some early beta version ready post it here for testing.

Alright! A very early version available now, mileage will probably vary, really curious if someone can get it to work and get feedback:

https://papayaphone.com/

So it is not chiliphone this time, because someone snatched my domain... Anyway, I realised that chili is not ideal in a domain name since it can be spelled both chili and chilli. So papaya it is! Similar service, different vegetable (or is it fruit?).

[DaveF]

Some thoughts.
1) Have to create an account & login? Why? Should be able to do this a bit more anonymously.

2) You need to have a 'test call' option. Browser / firewall / whatever compatibility is a thing and there are known issues with webrtc with certain security appliances.

https://www.reddit.com/r/sonicwall/comments/94efxq/sonicwall_possibly_blocking_webrtc_traffic/
https://campus.barracuda.com/product/webapplicationfirewall/doc/49054741/how-to-enable-websocket/
and so on....

-Dave

[dkbit98]

Alright! A very early version available now, mileage will probably vary, really curious if someone can get it to work and get feedback:

https://papayaphone.com/

Domain name papayaphone is cool, but nothing is showing for me on that website except error message, and I tried several different browsers.
Only browser that worked for me was Tor browser, so maybe there are restrictions for some IP addresses and regions?
I also wonder if Tor browser would even work and have a good call quality, so I didn't test it yet.
I did notice that QR code was not showing up when I created invoice, that is probably something related with strict Tor browser settings, but copy invoice would work just fine.
I guess this is related with HTML canvas image data that needs to be enabled.



This is error message I am getting in my Firefox/Librewolf browsers:

Code:

Secure Connection Failed

An error occurred during a connection to papayaphone.com. SSL received a record that exceeded the maximum permissible length.

Error code: SSL_ERROR_RX_RECORD_TOO_LONG

This is home page in Tor browser:



I would suggest that you add price rates for calls, so I would know how much I need to pay for one minute of conversation, or something like that.
For example this is how viber rates looks like:
https://account.viber.com/en/rates-index

[SFR10]

2) You need to have a 'test call' option.

It seems that it already has that option ^{[you just have to dial "801" and it doesn't require having an account]}.

• @limikael: Is the actual quality similar to what I've heard on the test call ^{[the delay felt like a couple of seconds (not sure if it has something to do with my net)]}?

I would suggest that you add price rates for calls, so I would know how much I need to pay for one minute of conversation, or something like that.

When you type in a correct/valid number, it'll show you the rates beneath the number ^{[not sure if it was added recently]}.

[limikael]

Thank you so much guys for testing!

Will summarise some points here...

- Regarding the delay for the echo test. Depends on what you mean... The way that echo test works, is that it records for 5 seconds, then
reads back the recording. So that part of the delay is by design. But then also, I have noticed a bit of delay which I think is because of the location of my server. Ideally it should be close to where the caller is. Since I'm in Indonesia, I put it in Singapore. Which I don't think is close to where my costumers will be, so I think I will move it. Eventually have several servers in different continents, but should probably start with North America or Europe rater than Asia.

- I don't have a "rate table", because there are many different rates depending on the number you are calling. The way to get the rate for a number is to type it in the number input field and it will be shown. It is not 100% clear that it is supposed to work that way though, so will add a note about it.

- Yep there is an echo test by calling the number 801. But it is a bit hard to find, so will add a note about that too.

- The reason why you have to create an account is because I thought it will be too easy to lose your credit otherwise. If you don't have an account, the only way to associate you with your credit would be through a cookie in the browser, so if you clear your cookies, the credit will be gone. But then again, this is actually the way e.g. lightning-roulette.com works, i.e. with a cookie. And it is also the way good old phone booths worked, they didn't have an "account", you just paid the money for one phone call before you made it. So I think I will introduce a kind of signup-less temporary accounts, where the credit will be associated with a cookie. This is actually the way my old service worked, and I think this is OK as long as it is clearly stated. Either that, or I could add meta mask support, which will give a more anonymous signup. I have thought about both of these options, which one do you think I should prioritise?

- I don't know where that SSL error comes from... () I tried with Firefox just now, and it worked fine for me. I haven't done a lot of cross browser testing though, so I think I will get myself an account at Browsersack to do that.

Alright, thanks a lot for testing and feedback! This gives me a to do list which I will chip away at. Will let you know when there is something new to test!