4 ms·

"You are so right. People forget that the cell companies know who you are and where you are 100% of the time." My mobile phone company has no idea who I am. I

by rsync 7y ago

"You are so right. People forget that the cell companies know who you are and where you are 100% of the time." My mobile phone company has no idea who I am. It was trivially easy to purchase an iphone, at the Apple store, with cash and then purchase a Verizon MVNO SIM from US Mobile (which I prefer over StraightTalk because they allow tethering). Neither Apple nor my MVNO nor Verizon knows who I am. I, personally, am not a customer of any mobile provider. Certainly my mobile provider could find out if they dug deeply enough - specifically, they could (somehow) check the Visa card I use for payment and see the corporation that that Visa card was issued to and then look up the corporate records and then ... they would know that somebody at X Corp is their customer. Possibly me. Remember: neither Visa nor Mastercard verifies purchaser name. Only AMEX does this. You can purchase online with your personal or corp Visa/MC and put in "Mickey Mouse" as the name - it will always work unless they are a very, very rare merchant (usually European) that has put the "Verified by Visa" component into their workflow.

pinkfoot 7y ago
Or the could: 1. sample the HSS (HLR in old-money) every night to find which phones are camping in which location areas (LAC)s; 2. this given them a phone → area location for every phone in the country, where area is about 200 cells (a few km²); 3. then they could draw out the call detail_record (CDR) of very outgoing call, SMS, and even data session to get the cell identity; 4. this gets the phone → area mapping down to a few hundred m²; 5. then if they are motivated, they will use the location services in the Mobile Application Part (MAP) to silently move every unknown phone into dedicated mode and repeatedly determine its location to within 10m - 50m; 6. if the phone has control plane, GPS, they just ask it that. Many, many phones do; 7. this information is collected all the time and passed to in-house and 'external' GIS teams to cross-reference against all sorts of wonderful data; 8. they know who you are. The good news is they don't care. They just want you to spend more. ARPU is everything. Source: I built this stuff for a living.
- rsync 7y ago
  All points well taken - and that I have a firm grasp on. My threat model is "telco or ISP employee decides to see if John is a customer and, if so, just what John does with his phone". They will not find me in their customer database and they'd have to dig fairly deeply, and possibly involve banks and/or LEAs which are not my threat model. Also, just as a coincidence, and not by design, my place of residence has zero bars of mobile service ... I lose it about two miles from where I live ...
  - pdoege 7y ago
    When I was playing the game we cross licensed with banks, credit agencies, and etc. I couldn't evade my own nets because I have a drivers license, property, and bank accounts. I'm sure that you've done better.
snarf21 7y ago
They generally know your location via tower triangulation. They know the sites you visiting via DNS or IP > reverse DNS. Combined with other data sources, they can get pretty close, probably exact. If you are not in a high rise apartment, they can guess your address and/or your work address based on normal 9-5 work patterns. They can map business to LinkedIn for employees of that company. I'm just trying to say that we leak a LOT of personal data to a LOT of people practically all the time. It is very very hard to stay anonymous today. Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network. It isn't here yet but is coming.
- rsync 7y ago
  "They generally know your location via tower triangulation." Correct, but to clarify - they know your SIM cards location. In my case this correlates to a corp name and no actual personal name (mine or otherwise). "Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network." I suspect you are correct and I think this is already de facto practice for a consumer purchasing mobile phone service in the United States. I suspect, however, that an EIN and a corp name will continue to allow SIM provisioning without associated PII. Something to consider: we are promised many, many more 5G SIM cards on the network than there are people on the planet. Most of those SIMs will be provisioned by corporate entities and, therefore, the ability to procure and deploy SIMs with no PII will persist ...
  - yborg 7y ago
    This is naive. Via triangulation they know your approximate location, and there are likely cameras with facial recognition and/or license plate readers in the area that can be used to correlate with arrival/departure to get your identity. Unless every single thing you use is in somebody else's name and you wear some kind of disguise everywhere it is already possible to bypass anonymity in most urban areas. If someone isn't doing it already someone will be soon, there's a lot of money at stake.
  - thu2111 7y ago
    No it won't. Anonymous SIMs were already wiped out in large areas of the world. The way KYC works is you need to know the "beneficial owner" i.e. ultimate owner of an asset. The bazillions of 5G sims we're promised will all be tied to a strongly verified corporate identity and to get on a network will require you to present ID if an individual, or do corp KYC if a firm (which will in turn require the heads of the company to do personal KYC to establish beneficial ownership information). Remember, this isn't even new for many countries.
Mediterraneo10 7y ago
> My mobile phone company has no idea who I am. It was trivially easy to purchase an iphone, at the Apple store, with cash and then purchase a Verizon MVNO SIM from US Mobile (which I prefer over StraightTalk because they allow tethering). You may be able to do this in the US for the time being. However, in many countries already – a list that is steadily increasing – you cannot purchase a SIM card without showing ID, a copy of which is made and forwarded to state authorities. In other countries – I know of at least Chile – you may have to register the IMEI of the phone as well.
tomnipotent 7y ago
> then purchase a Verizon MVNO SIM from US Mobile Are you paying with a pre-paid card? If not, your number is tied to your card which is tied to your identity.

by rsync 7y ago

pinkfoot 7y ago

Or the could: 1. sample the HSS (HLR in old-money) every night to find which phones are camping in which location areas (LAC)s; 2. this given them a phone → area location for every phone in the country, where area is about 200 cells (a few km²); 3. then they could draw out the call detail_record (CDR) of very outgoing call, SMS, and even data session to get the cell identity; 4. this gets the phone → area mapping down to a few hundred m²; 5. then if they are motivated, they will use the location services in the Mobile Application Part (MAP) to silently move every unknown phone into dedicated mode and repeatedly determine its location to within 10m - 50m; 6. if the phone has control plane, GPS, they just ask it that. Many, many phones do; 7. this information is collected all the time and passed to in-house and 'external' GIS teams to cross-reference against all sorts of wonderful data; 8. they know who you are. The good news is they don't care. They just want you to spend more. ARPU is everything. Source: I built this stuff for a living.

rsync 7y ago
All points well taken - and that I have a firm grasp on. My threat model is "telco or ISP employee decides to see if John is a customer and, if so, just what John does with his phone". They will not find me in their customer database and they'd have to dig fairly deeply, and possibly involve banks and/or LEAs which are not my threat model. Also, just as a coincidence, and not by design, my place of residence has zero bars of mobile service ... I lose it about two miles from where I live ...
- pdoege 7y ago
  When I was playing the game we cross licensed with banks, credit agencies, and etc. I couldn't evade my own nets because I have a drivers license, property, and bank accounts. I'm sure that you've done better.

snarf21 7y ago

They generally know your location via tower triangulation. They know the sites you visiting via DNS or IP > reverse DNS. Combined with other data sources, they can get pretty close, probably exact. If you are not in a high rise apartment, they can guess your address and/or your work address based on normal 9-5 work patterns. They can map business to LinkedIn for employees of that company. I'm just trying to say that we leak a LOT of personal data to a LOT of people practically all the time. It is very very hard to stay anonymous today. Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network. It isn't here yet but is coming.

rsync 7y ago
"They generally know your location via tower triangulation." Correct, but to clarify - they know your SIM cards location. In my case this correlates to a corp name and no actual personal name (mine or otherwise). "Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network." I suspect you are correct and I think this is already de facto practice for a consumer purchasing mobile phone service in the United States. I suspect, however, that an EIN and a corp name will continue to allow SIM provisioning without associated PII. Something to consider: we are promised many, many more 5G SIM cards on the network than there are people on the planet. Most of those SIMs will be provisioned by corporate entities and, therefore, the ability to procure and deploy SIMs with no PII will persist ...
- yborg 7y ago
  This is naive. Via triangulation they know your approximate location, and there are likely cameras with facial recognition and/or license plate readers in the area that can be used to correlate with arrival/departure to get your identity. Unless every single thing you use is in somebody else's name and you wear some kind of disguise everywhere it is already possible to bypass anonymity in most urban areas. If someone isn't doing it already someone will be soon, there's a lot of money at stake.
- thu2111 7y ago
  No it won't. Anonymous SIMs were already wiped out in large areas of the world. The way KYC works is you need to know the "beneficial owner" i.e. ultimate owner of an asset. The bazillions of 5G sims we're promised will all be tied to a strongly verified corporate identity and to get on a network will require you to present ID if an individual, or do corp KYC if a firm (which will in turn require the heads of the company to do personal KYC to establish beneficial ownership information). Remember, this isn't even new for many countries.

Mediterraneo10 7y ago

> My mobile phone company has no idea who I am. It was trivially easy to purchase an iphone, at the Apple store, with cash and then purchase a Verizon MVNO SIM from US Mobile (which I prefer over StraightTalk because they allow tethering). You may be able to do this in the US for the time being. However, in many countries already – a list that is steadily increasing – you cannot purchase a SIM card without showing ID, a copy of which is made and forwarded to state authorities. In other countries – I know of at least Chile – you may have to register the IMEI of the phone as well.

tomnipotent 7y ago

> then purchase a Verizon MVNO SIM from US Mobile Are you paying with a pre-paid card? If not, your number is tied to your card which is tied to your identity.