Cloaked Detailed Review

Several readers of my books have been asking about a newer service called Cloaked. At first glance, I saw they offered some type of email masking and VoIP telephone service, and I delayed a full review toward the end of a long list of pending tasks. I finally got around to taking a deep dive, and there is much more there than I thought. This review will be longer than I anticipated, because I was also able to test their masked payment option. There is a lot to discuss.

First, I was not paid or asked to write this review and there was no editorial control or input from any third party. These are my thoughts. First, the easy stuff.

On-Boarding: Creating an account was easy, and they accepted a Proton Mail email address. There seemed to be no verification of identity and automated confirmation emails arrived immediately. I was issued a two-week free trial, which appeared to be fully-functioning. That gave me plenty of time to play around without commitment. So far, so good.

Layout: The web layout was very polished and easy to navigate. Everything seemed to function properly. The mobile app layout was also nicely done. I had no complaints, and everything seemed professional.

Email: Nothing too exciting here. It works fine. Create an identity and get an auto-generated email address at a Cloaked domain. You can choose whether you want incoming messages to stay within the Cloaked portal or be forwarded to your registered email address. I chose to leave them within Cloaked. It seemed I could create unlimited Identities, each with their own masked email address and optional usernames and passwords.

VoIP: This is where things got interesting. I had assumed they were offering true two-way unlimited-use VoIP telephone numbers. This was surprising since they claim to offer unlimited numbers for a flat membership fee, and that would be an absolute steal. I soon realized this was not the case. Cloaked does offer unlimited telephone numbers, but there are major restrictions.

1) You can only call numbers which have previously called or texted you first.

2) You can only text numbers which have previously called or texted you first.

3) All voice calls are routed through your own true cellular number (if connected via the app), but masked to display your VoIP number as the caller ID.

4) If you did not connect a cell number to the app, then incoming calls go to voicemail.

That is a lot to digest. Here is how it all works. You are in need of a telephone number to provide some type of service (healthcare, shopping, streaming, etc.). You generate a new "Identity" within Cloaked and ask to have a number generated. That VoIP number is assigned to you and it can be given to the service. If the service calls that number, it will forward to you. If anyone else calls that number, it will forward to you. If you did not associate your true cellular number within the mobile app, the call goes to voicemail and you can listen to the message in your portal (web or app). If you associated your cellular number with the app, the call is received at Cloaked; forwarded to your true cellular number from their servers; presented to your mobile calling app as a random Cloaked number; and the call can be answered. If you choose to call the provider back (mobile app only), the call is routed through Cloaked servers and presented to the original caller as coming from the Cloaked number assigned to your Identity. Got all that?

This is actually not anything new. Online VoIP providers have been offering similar services for years. This is how Cloaked can afford to issue you unlimited numbers for every purpose. If needed, you could have 30 Identities for 30 services, with 30 unique numbers. Again, this presents a serious limitation. You cannot call any receiving number from a Cloaked number until that receiving number calls you. Same for SMS text. If you want to call a restaurant to confirm a reservation, but they have never called you, you cannot do that. Traditional VoIP providers allow this, but you pay a premium fee for every number you possess.

If you receive no calls or text messages into a number issued by Cloaked within 60 days, they reclaim that number and recycle it to another user. This is concerning, but they have an option to "Lock" the number for permanent use. Once you do this, no other incoming calls or messages can be received, but any numbers which have connected to you are locked in. If you give your doctor's office a Cloaked number, they call it and you are now connected to them. If you lock the number, then that office (from the number which has already called you) will forever be forwarded to your account without expiration. However, if they call from a different number, it will not go through. I worry about "collisions" with this method, but I may just need more time to digest it. If I lock a number which has received a call from my doctor, and that number is re-issued to another Cloaked user for all other purposes, and he has the same doctor as me, would I receive the call intended for him? I do not have the answer, but I am working on some tests.

Personally, I do not connect my true cellular number to my account. I never use that number for any purpose. Also, if you forward calls and text messages through your true number, even though you are masking that number from anyone on the other end, you are creating a lot of metadata with your cellular provider. All of those calls are now documented by your ISP, but they would all show you were calling Cloaked servers. All of your voice calls use your own cellular minutes on your cellular network. I prefer to simply receive a voicemail which I can listen to through the web or app. I can also send and receive SMS messages directly through web or app once I am connected to another number.

Pricing: During your trial, you will likely receive an offer to upgrade to the full version at a discounted rate ($4x annually). If you plan to upgrade, take this offer. Once my trial was over, I could only renew at the upgrade rate ($5x-$6x annually). Their website lists $96 as the full-price annual rate. I believe anything less than $60 is a great price for the service. On one device, we were allowed to use a Privacy.com card, but on another we were blocked. If you will be using this as a way to connect to services under your true name, I see no reason to hide your identity. I used my AMEX to make the purchase.

Documentation: Cloaked offers plenty of fields to name your identities and provide data such as the company, website, password, notes, etc. I do not use much of this, but it is well done. Below is a screen capture.

Wallet: This was the most interesting part for me. I rely heavily on Privacy.com and want a redundant option for masked payments. I requested to join the Cloaked beta program for masked payments and was accepted. I had to provide my true name, DOB, and SSN for financial verification. This will upset some, but should be no surprise. US laws require financial institutions to verify their customers. I was excited that I was confirmed on the first try. From there, you must connect a source of payment. You can connect a bank account, debit card, or credit card. I chose my business AMEX credit card and it connected through a third-party processor called Stripe. I have no objection to any of that association. There is no such thing as a completely anonymous US financial account. I could then generate new cards and select the available dollar amount and limits (day/week/month/one-time/fixed). Cloaked placed an authorization on my credit card for the amount I approved on the card. This issued me a MasterCard for use online. I tested this by making a payment for my trash service. Everything worked as expected, and very similar to Privacy.com. My AMEX showed a charge from Cloaked, but not the merchant. The merchant saw my alias and Cloaked card number, but not my AMEX. Unlike Privacy.com, I did not have to associate any bank account or provide account credentials for verification. Stripe made the connection to my credit card with minimal details.

Future: I had my office reach out to Cloaked about a few issues we were investigating, and the CEO confirmed they have many new features on the immediate horizon. I will not disclose them here, that is up to them. However, I believe the pricing will fluctuate upward once we start to see major new features. If you have a need for this type of service, I would join at the lowest rate you can get now, and hope to be grandfathered in.

Affiliate: Cloaked offers an affiliate program to refer people to their service. I have not tested this, but supposedly you and I each receive $10-$25 if you use the following link to create your free trial account and then upgrade to a paid plan. This link will lock you into a free two-week unlimited trial with no commitment.

https://try.cloaked.app/vAk1/2hrvbzxoyx

Who is this good for? I think it is a great option if you need many phone numbers and only want to use each for a single purpose. Get them connected, lock them in, and forget about them. It may be an option for people who are unable to use Twilio, Telnyx, VoIP.ms, etc. However, it is not a good fit for people who need a fully-functioning two-way telephone number. If you make many outgoing calls, this is not for you. This is an option to mask mostly INCOMING connections, which has value. I have no idea what the current wait-list is for the beta program for their wallet service. If you can get in, I see even more value there.

How will I use this? I will create one-time VoIP numbers and email aliases through the Cloaked app or web interface. I will receive only voicemails and text through the service with no forwarding whatsoever. I have seen reports from users that creating hundreds of phone numbers will get your account locked, which I respect. I currently possess 40 numbers and everything just works. I will lock in numbers in order to prevent them from disappearing when appropriate. I will continue to test the payment options.

Overall, I like this service for what it is. It is a great incoming communication mask with payment option. I will still maintain my other VoIP solutions for true two-way unlimited usage. I believe we will see continuous changing and evolving from Cloaked. Once new features arise, I will update this review within UNREDACTED Magazine.

Black Hat Las Vegas

Jason will be teaching the official IntelTechniques OSINT course at BlackHat Las Vegas again this year. We believe it is the best OSINT course being offered and limited the seats this time. If you are interested:

https://www.blackhat.com/us-24/training/schedule/#inteltechniques--day-osint-training-37266

As always, we recommend individuals who self-pay start with our way more affordable online training. If your employer is paying, or you have a voucher, we have lots of new things planned for the live course.

Digital Guide Updates 2024.05.01

Today, we updated all six of our digital supplement guides. If you purchased any, please check your email for the download link(s). If you would like more information on these guides, please visit https://inteltechniques.com/books.html. The following provides details of each update:

OSINT Techniques-Leaks, Breaches, and Logs:
Page 92 (Minor): Added note about torrent file completion.
Page 93 (Minor): Added note about missing Telegram room.
Page 94 (Minor): Added note about missing Telegram room.

OSINT Techniques-The Ultimate Virtual Machine:
Pages 213-215 (Major): Added section explaining free Caller ID APIs through RapidAPI.
Entire Book (Major): Updated the script access credentials for the updated scripts.

Extreme Privacy-Mobile Devices:
Pages 41 and 46 (Minor): Added Simple Apps alternative Fossify
Pages 83-88 (Major): Added new section for Encrypted mobile VoIP Communications for Twilio, Telnyx, and VoIP.ms.
Page 126 (Minor): Updated 2FA section to match new pricing models and advice.

Extreme Privacy-macOS Devices:
Pages 93-96 (Major): Added new section for Encrypted maOS desktop VoIP Communications for Twilio, Telnyx, and VoIP.ms.

Extreme Privacy-Linux Devices:
Pages 84-87 (Major): Added new section for Encrypted Linux desktop VoIP Communications for Twilio, Telnyx, and VoIP.ms.

Extreme Privacy-VPNs and Firewalls:
Page 77 (Minor): Updated Wi-Fi router recommendations.
Page 78 (Minor): Updated Current OpenWRT Configuration

Digital Guide Updates 2024.04.01

Today, we updated all six digital supplement guides. If you purchased any, please check your email for the download link(s). If you would like more information on these guides, please visit https://inteltechniques.com/books.html. The following provides details of each update:

OSINT Techniques-Leaks, Breaches, & Logs:
Page 161-163: Updated and combined SQLite commands for better overall functionality and copy/paste. This new way of creating and updating a SQLite Logs database should be faster with a smaller file size.

OSINT Techniques-The Ultimate Virtual Machine:
Page 92: Added paragraph about optimal settings for Firefox's "Global Privacy Control" and "Do Not Track" for OSINT work.

Extreme Privacy-Mobile Devices:
Pages 95-96: Added section about VoIP Fax Service
Page 106: Added note about Signal usernames

Extreme Privacy-macOS Devices:
Page 47: Added settings for Firefox's "Global Privacy Control" and "Do Not Track".
Pages 95-96: Added section about VoIP Fax Service

Extreme Privacy-Linux Devices:
Page 38: Added settings for Firefox's "Global Privacy Control" and "Do Not Track".
Pages 86-87: Added section about VoIP Fax Service

Extreme Privacy-VPNs and Firewalls:
Page 45: Added section about standby Proton VPN server addresses
Page 82: Added settings for Firefox's "Global Privacy Control" and "Do Not Track".

VPNs & Firewalls Update

We just published an update to our VPNs and Firewalls digital guide. If you purchased this guide, please check your email for an important update which addresses missing pfSense updates on some devices and the upcoming pfSense DHCP changes.