6 ms·

This is actually good. IMEI is a unique number that can identify each device. And is huge privacy issue as it can be used against the user, can individually tra

This is actually good. IMEI is a unique number that can identify each device. And is huge privacy issue as it can be used against the user, can individually track each user. IMEI is not required when placing calls or transferring data since this is securely managed by the GSM chip.

bzb4 6y ago
IMEI is used to block stolen phones from registering on the network. Being able to make stolen phones unusable is a good thing.
- ta17711771 6y ago
  Alternative: we could shoot the person trying to steal our phone, and NOT be tracked by IMEI. For the "more reasonable" HNers...how about an opt-out of the feature?
Klinky 6y ago
Are you sure this would not cause problems if two devices with the same IMEI were on the same tower, or even same provider? It might look fishy having multiple dups floating around on your network. If one of these devices gets IMEI blacklisted, now all 13.5K devices are blacklisted... Not so good.
- stefan_ 6y ago
  Providers issue SIM (subscriber identity module) cards to uniquely authenticate subscribers to their network. Why do you need something that is constant across SIM cards? It's superfluous identifying information (GDPR wants a word!).
  - toast0 6y ago
    It might make things difficult for emergency calls without a SIM? It's been a while since I looked at protocol spec around that, I don't know if you can get a TMSI without an IMSI, if you can, things would probably be OK as long as two phones didn't turn on and access the same tower at once.
    - stefan_ 6y ago
      It's like the MAC address of your smartphone WiFi radio. Yes, you'll get problems if there are two identical ones in the same cell, but in practice randomizing the MAC works perfectly fine.
      - yuubi 6y ago
        Except not. The MAC-layer identity in LTE is the RNTI, which is temporarily assigned by each cell before the mobile transmits any sort of unique ID.
  - Klinky 6y ago
    Because SIM identifies subscriber, and IMEI identifies equipment. They are not the same thing.
  - derefr 6y ago
    Anti-theft. The device itself needs an identifier, so that if someone steals your device—immediately turning it off, re-flashing the OS, and putting their SIM in it, before booting it back up—then the network will still have some identifier to recognize the device itself by, so that it can say “nope, that’s stolen” and refuse to let it onto the network (thus disincentivizing stealing cellphones in the first place.) I believe network-IMEI-registration isn’t the primary mechanism by which modern phone anti-theft works by, though, since the device-owner is free to change the phone’s network-reported IMEI (much like you can change an Ethernet controller’s network-reported MAC address.) I might be wrong here, though; the phone’s baseband might come up with its burned-in IMEI and check for validity with the server, before switching to any application-processor-requested IMEI. (You can get around that by just booting up the phone in a Faraday cage—but having to do that every time would definitely decrease the black-market resale value.) For iOS, at least, I think the anti-theft works by getting onto wi-fi each time the SIM changes and asking some activation server about the validity of [some other internal static device-ID that can’t be tampered with in this way]. Not so sure what, if anything, Android does (Android’s case is harder, since for phones with an unlocked bootloader, you can always flash an altered firmware that has no anti-theft logic.)
    - mindslight 6y ago
      The same anti-theft argument could be used to justify building surveillance tech into any object, and yet our society seems to function just fine without it. I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Yet we all get tracked every single day due to this user-hostile design. Also for most phones it's trivial to change the IMEI to resell the phone, or simply part it out. Which sure, are more things manufacturers see as bugs, to the frustration of legitimate activity - hence Right to Repair. The majority of the world is honest. Let's not build ourselves into a prison just to fallaciously protect against the few who aren't.
      - derefr 6y ago
        > I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Errr, to be clear, the reason that phones don’t get stolen is that there are anti-theft measures in place. People steal similar types of item (e.g. car stereos, game consoles, Blu-ray players) all the time. There’s no reason other than anti-theft measures that phones as a type of item would be stolen any less than these other categories. (They’d actually be stolen far more, since they’re small/easy to slip into one’s clothes/not a weird thing to be carrying around; and are often found just left on tables at cafes or hanging out of people’s back pockets. They’re like cash, basically.) It’s the same reason that people steal bicycles more often than they steal cars. Bicycles, despite being worth much less, are just much easier to steal. > The majority of the world is honest. Do you live in a city? I’ve had my bicycle stolen five times now. I’ve also been mugged twice. I’ve never had my phone stolen, though—because it’s worthless to the sort of dumb criminals who steal things just to hawk them on the street, rather than to fence them. It doesn’t require a large fraction of the world to be dishonest, to result in most people in the world having crimes committed against them. A thief will steal from far more than one person in their thieving career. Especially in regimes where the computed ROI for going after certain types of thief (e.g. homeless, drug-addicted thieves) is negative (i.e. their prison housing costs society more than their thieving does, apparently), and so they’re never held for more than a day or two.
- tinus_hn 6y ago
  If this was a real problem it would have surfaced earlier. The unique IMEI is a privacy issue with no use for the consumer.
  - willis936 6y ago
    It is a real issue in the sense that phones reported lost or stolen to carriers results in an IMEI ban. It doesn't matter what the technical advantages to the end user are, what matters is if a carrier suddenly decides to shut off a thousand phones because they made an assumption about the nature of IMEIs that is expected to always be true.
    - novok 6y ago
      In today's world of activation locked iPhones being far more effective in preventing theft than IMEI banning, it's time to get rid of privacy breaking things like IMEIs.
    - shirshak55 6y ago
      Changing imei is a very easy task here. People can unlock apple iphone with 50$ etc so I think having same IMEI is good at least for privacy.
- derefr 6y ago
  From what I understand, IMEI really isn’t used for much these days in modern signalling protocols (and even OS anti-theft logic), precisely because it’s been left up to manufacturers to allocate IMEIs, and some manufacturers are dumb and make mistakes like this. For MAC addresses (also mfgr-allocated) mistakes like this are “fine”, because MAC addresses are layer-2 (switch-local) and therefore a collision will translate to a direct, customer-visible problem: they’ll buy two of the same device, and then their LAN will start acting wonky. As such, market forces will address dumb Ethernet equipment mfgrs, pushing them out of the market as customers stop buying them. But the people buying cellular handsets aren’t the same people running the network, so there are no market forces in play to push back against dumb handset mfgrs. Instead, the network operators must just play with the hand they’re dealt; and that means coming up with alternative strategies for managing handset connectivity that don’t involve the theoretical primary key (IMEI) but instead make use of other unique keys (e.g. IMSI) that are also included in the connection handshake.
  - thaumasiotes 6y ago
    I have to ask - where did the "g" come from in "manufacturer"?
    - Sevaris 6y ago
      I think mfg usually stands for manufacturing. So it seems he's talking about manufacturingers. Not sure what the difference is between that and manufacturer though.
    - derefr 6y ago
      It's the common abbreviation, but I wasn't sure as to its origin myself; the closest to a straight answer I can find is from https://boards.straightdope.com/sdmb/showthread.php?t=639390 https://boards.straightdope.com/sdmb/showthread.php?t=639390: > mfg came from manufacturing; its existence meant that some people started using it for manufacturer as well; but having a g in the abbreviation without one in the word bothered people, so they added an r to make it mfgr. This leads me to wish there was a well-researched blog for abbreviation/initialism/acronym etymologies, the way https://grammarphobia.com/ https://grammarphobia.com/ is for English word etmologies. But I guess there aren't that many of these that are in need of explanation; usually they're pretty obvious.
- jacobush 6y ago
  I have one of the early GSM phones with IMEI 0 or no IMEI, I forget how it works.
- yuubi 6y ago
  At least in LTE, the IMEI isn't a necessary part of connection setup. The network identifies the user seeking to connect by a temporary identifier if one of those is allocated or by the IMSI if that's all the user has. After the network and user pass a mutual authentication procedure, the core network may optionally ask for IMEI. The identifiers actually used over the air are the IMSI (normally written once at the SIM factory and never changed, used as a fallback if no other identity is available), the TMSI (assigned by the core network when the user attaches, can be reassigned at every attach, service request (return from idle to active state), or mobility event that the core knows about), and RNTI (assigned by each cell, changes at each handover, used to address each downlink transmission to the mobile and I think included in the CRC in each uplink transmission from the mobile). If you just receive a random transmission off the air, you can get the RNTI; if you receive an initial signaling message to the core network you'll get the current TMSI if assigned; you'll see the IMSI only in case of a new SIM or a SIM where the core network has forgotten who it assigned that TMSI to. There are also some temporary identifiers between the cell and the core network allocated when the cell starts talking to a mobile and released when the mobile goes idle, but these never reach the mobile. The core knows the IMSI and optionally IMEI of everyone connected. In normal operation, each cell only knows some temporary identifiers (it has the opportunity to record IMSI if the mobile sends it, but the mobile doesn't normally do that). All the details are available from 3gpp.org, and I can be more specific about which section of which doc if anyone actually cares.
  - Klinky 6y ago
    This is good info. Thank you.
achow 6y ago
Yes can identify devices and therefore helps in law enforcement (crime, terrorism).
- 1ris 6y ago
  But it also helps in law enforcement (surveillance state, supression).
DaniloDias 6y ago
This is actually not good. There is an IMEI database which can be used to prevent stolen phones from attaching to a network. If this IMEI is added, all of these devices will be prevented from registering.
- greatpatton 6y ago
  Having been working in telco, it is known that this DB is of no use because not all telco operators are participating. The stolen phone gets shipped very quickly oversea/outside of the country defeating completely this database.
joyj2nd 6y ago
You can actually fake the IMEI number on some phones. Be advised that this is a crime in several jurisdictions. (The UK being one of them if I remember correctly)
- sudosysgen 6y ago
  You can really fake the IMEI in most phones. It's just more difficult, or not obvious on the English internet, to do so.
dehrmann 6y ago
IMEI Spartacus?

bzb4 6y ago

IMEI is used to block stolen phones from registering on the network. Being able to make stolen phones unusable is a good thing.

ta17711771 6y ago
Alternative: we could shoot the person trying to steal our phone, and NOT be tracked by IMEI. For the "more reasonable" HNers...how about an opt-out of the feature?

Klinky 6y ago

Are you sure this would not cause problems if two devices with the same IMEI were on the same tower, or even same provider? It might look fishy having multiple dups floating around on your network. If one of these devices gets IMEI blacklisted, now all 13.5K devices are blacklisted... Not so good.

stefan_ 6y ago
Providers issue SIM (subscriber identity module) cards to uniquely authenticate subscribers to their network. Why do you need something that is constant across SIM cards? It's superfluous identifying information (GDPR wants a word!).
- toast0 6y ago
  It might make things difficult for emergency calls without a SIM? It's been a while since I looked at protocol spec around that, I don't know if you can get a TMSI without an IMSI, if you can, things would probably be OK as long as two phones didn't turn on and access the same tower at once.
  - stefan_ 6y ago
    It's like the MAC address of your smartphone WiFi radio. Yes, you'll get problems if there are two identical ones in the same cell, but in practice randomizing the MAC works perfectly fine.
    - yuubi 6y ago
      Except not. The MAC-layer identity in LTE is the RNTI, which is temporarily assigned by each cell before the mobile transmits any sort of unique ID.
- Klinky 6y ago
  Because SIM identifies subscriber, and IMEI identifies equipment. They are not the same thing.
- derefr 6y ago
  Anti-theft. The device itself needs an identifier, so that if someone steals your device—immediately turning it off, re-flashing the OS, and putting their SIM in it, before booting it back up—then the network will still have some identifier to recognize the device itself by, so that it can say “nope, that’s stolen” and refuse to let it onto the network (thus disincentivizing stealing cellphones in the first place.) I believe network-IMEI-registration isn’t the primary mechanism by which modern phone anti-theft works by, though, since the device-owner is free to change the phone’s network-reported IMEI (much like you can change an Ethernet controller’s network-reported MAC address.) I might be wrong here, though; the phone’s baseband might come up with its burned-in IMEI and check for validity with the server, before switching to any application-processor-requested IMEI. (You can get around that by just booting up the phone in a Faraday cage—but having to do that every time would definitely decrease the black-market resale value.) For iOS, at least, I think the anti-theft works by getting onto wi-fi each time the SIM changes and asking some activation server about the validity of [some other internal static device-ID that can’t be tampered with in this way]. Not so sure what, if anything, Android does (Android’s case is harder, since for phones with an unlocked bootloader, you can always flash an altered firmware that has no anti-theft logic.)
  - mindslight 6y ago
    The same anti-theft argument could be used to justify building surveillance tech into any object, and yet our society seems to function just fine without it. I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Yet we all get tracked every single day due to this user-hostile design. Also for most phones it's trivial to change the IMEI to resell the phone, or simply part it out. Which sure, are more things manufacturers see as bugs, to the frustration of legitimate activity - hence Right to Repair. The majority of the world is honest. Let's not build ourselves into a prison just to fallaciously protect against the few who aren't.
    - derefr 6y ago
      > I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Errr, to be clear, the reason that phones don’t get stolen is that there are anti-theft measures in place. People steal similar types of item (e.g. car stereos, game consoles, Blu-ray players) all the time. There’s no reason other than anti-theft measures that phones as a type of item would be stolen any less than these other categories. (They’d actually be stolen far more, since they’re small/easy to slip into one’s clothes/not a weird thing to be carrying around; and are often found just left on tables at cafes or hanging out of people’s back pockets. They’re like cash, basically.) It’s the same reason that people steal bicycles more often than they steal cars. Bicycles, despite being worth much less, are just much easier to steal. > The majority of the world is honest. Do you live in a city? I’ve had my bicycle stolen five times now. I’ve also been mugged twice. I’ve never had my phone stolen, though—because it’s worthless to the sort of dumb criminals who steal things just to hawk them on the street, rather than to fence them. It doesn’t require a large fraction of the world to be dishonest, to result in most people in the world having crimes committed against them. A thief will steal from far more than one person in their thieving career. Especially in regimes where the computed ROI for going after certain types of thief (e.g. homeless, drug-addicted thieves) is negative (i.e. their prison housing costs society more than their thieving does, apparently), and so they’re never held for more than a day or two.
tinus_hn 6y ago
If this was a real problem it would have surfaced earlier. The unique IMEI is a privacy issue with no use for the consumer.
- willis936 6y ago
  It is a real issue in the sense that phones reported lost or stolen to carriers results in an IMEI ban. It doesn't matter what the technical advantages to the end user are, what matters is if a carrier suddenly decides to shut off a thousand phones because they made an assumption about the nature of IMEIs that is expected to always be true.
  - novok 6y ago
    In today's world of activation locked iPhones being far more effective in preventing theft than IMEI banning, it's time to get rid of privacy breaking things like IMEIs.
  - shirshak55 6y ago
    Changing imei is a very easy task here. People can unlock apple iphone with 50$ etc so I think having same IMEI is good at least for privacy.
derefr 6y ago
From what I understand, IMEI really isn’t used for much these days in modern signalling protocols (and even OS anti-theft logic), precisely because it’s been left up to manufacturers to allocate IMEIs, and some manufacturers are dumb and make mistakes like this. For MAC addresses (also mfgr-allocated) mistakes like this are “fine”, because MAC addresses are layer-2 (switch-local) and therefore a collision will translate to a direct, customer-visible problem: they’ll buy two of the same device, and then their LAN will start acting wonky. As such, market forces will address dumb Ethernet equipment mfgrs, pushing them out of the market as customers stop buying them. But the people buying cellular handsets aren’t the same people running the network, so there are no market forces in play to push back against dumb handset mfgrs. Instead, the network operators must just play with the hand they’re dealt; and that means coming up with alternative strategies for managing handset connectivity that don’t involve the theoretical primary key (IMEI) but instead make use of other unique keys (e.g. IMSI) that are also included in the connection handshake.
- thaumasiotes 6y ago
  I have to ask - where did the "g" come from in "manufacturer"?
  - Sevaris 6y ago
    I think mfg usually stands for manufacturing. So it seems he's talking about manufacturingers. Not sure what the difference is between that and manufacturer though.
  - derefr 6y ago
    It's the common abbreviation, but I wasn't sure as to its origin myself; the closest to a straight answer I can find is from https://boards.straightdope.com/sdmb/showthread.php?t=639390 https://boards.straightdope.com/sdmb/showthread.php?t=639390: > mfg came from manufacturing; its existence meant that some people started using it for manufacturer as well; but having a g in the abbreviation without one in the word bothered people, so they added an r to make it mfgr. This leads me to wish there was a well-researched blog for abbreviation/initialism/acronym etymologies, the way https://grammarphobia.com/ https://grammarphobia.com/ is for English word etmologies. But I guess there aren't that many of these that are in need of explanation; usually they're pretty obvious.
jacobush 6y ago
I have one of the early GSM phones with IMEI 0 or no IMEI, I forget how it works.
yuubi 6y ago
At least in LTE, the IMEI isn't a necessary part of connection setup. The network identifies the user seeking to connect by a temporary identifier if one of those is allocated or by the IMSI if that's all the user has. After the network and user pass a mutual authentication procedure, the core network may optionally ask for IMEI. The identifiers actually used over the air are the IMSI (normally written once at the SIM factory and never changed, used as a fallback if no other identity is available), the TMSI (assigned by the core network when the user attaches, can be reassigned at every attach, service request (return from idle to active state), or mobility event that the core knows about), and RNTI (assigned by each cell, changes at each handover, used to address each downlink transmission to the mobile and I think included in the CRC in each uplink transmission from the mobile). If you just receive a random transmission off the air, you can get the RNTI; if you receive an initial signaling message to the core network you'll get the current TMSI if assigned; you'll see the IMSI only in case of a new SIM or a SIM where the core network has forgotten who it assigned that TMSI to. There are also some temporary identifiers between the cell and the core network allocated when the cell starts talking to a mobile and released when the mobile goes idle, but these never reach the mobile. The core knows the IMSI and optionally IMEI of everyone connected. In normal operation, each cell only knows some temporary identifiers (it has the opportunity to record IMSI if the mobile sends it, but the mobile doesn't normally do that). All the details are available from 3gpp.org, and I can be more specific about which section of which doc if anyone actually cares.
- Klinky 6y ago
  This is good info. Thank you.

achow 6y ago

Yes can identify devices and therefore helps in law enforcement (crime, terrorism).

1ris 6y ago
But it also helps in law enforcement (surveillance state, supression).

DaniloDias 6y ago

This is actually not good. There is an IMEI database which can be used to prevent stolen phones from attaching to a network. If this IMEI is added, all of these devices will be prevented from registering.

greatpatton 6y ago
Having been working in telco, it is known that this DB is of no use because not all telco operators are participating. The stolen phone gets shipped very quickly oversea/outside of the country defeating completely this database.

joyj2nd 6y ago

You can actually fake the IMEI number on some phones. Be advised that this is a crime in several jurisdictions. (The UK being one of them if I remember correctly)

sudosysgen 6y ago
You can really fake the IMEI in most phones. It's just more difficult, or not obvious on the English internet, to do so.

dehrmann 6y ago

IMEI Spartacus?