6 ms·

Providers issue SIM (subscriber identity module) cards to uniquely authenticate subscribers to their network. Why do you need something that is constant across

Providers issue SIM (subscriber identity module) cards to uniquely authenticate subscribers to their network. Why do you need something that is constant across SIM cards? It's superfluous identifying information (GDPR wants a word!).

toast0 6y ago
It might make things difficult for emergency calls without a SIM? It's been a while since I looked at protocol spec around that, I don't know if you can get a TMSI without an IMSI, if you can, things would probably be OK as long as two phones didn't turn on and access the same tower at once.
- stefan_ 6y ago
  It's like the MAC address of your smartphone WiFi radio. Yes, you'll get problems if there are two identical ones in the same cell, but in practice randomizing the MAC works perfectly fine.
  - yuubi 6y ago
    Except not. The MAC-layer identity in LTE is the RNTI, which is temporarily assigned by each cell before the mobile transmits any sort of unique ID.
Klinky 6y ago
Because SIM identifies subscriber, and IMEI identifies equipment. They are not the same thing.
derefr 6y ago
Anti-theft. The device itself needs an identifier, so that if someone steals your device—immediately turning it off, re-flashing the OS, and putting their SIM in it, before booting it back up—then the network will still have some identifier to recognize the device itself by, so that it can say “nope, that’s stolen” and refuse to let it onto the network (thus disincentivizing stealing cellphones in the first place.) I believe network-IMEI-registration isn’t the primary mechanism by which modern phone anti-theft works by, though, since the device-owner is free to change the phone’s network-reported IMEI (much like you can change an Ethernet controller’s network-reported MAC address.) I might be wrong here, though; the phone’s baseband might come up with its burned-in IMEI and check for validity with the server, before switching to any application-processor-requested IMEI. (You can get around that by just booting up the phone in a Faraday cage—but having to do that every time would definitely decrease the black-market resale value.) For iOS, at least, I think the anti-theft works by getting onto wi-fi each time the SIM changes and asking some activation server about the validity of [some other internal static device-ID that can’t be tampered with in this way]. Not so sure what, if anything, Android does (Android’s case is harder, since for phones with an unlocked bootloader, you can always flash an altered firmware that has no anti-theft logic.)
- mindslight 6y ago
  The same anti-theft argument could be used to justify building surveillance tech into any object, and yet our society seems to function just fine without it. I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Yet we all get tracked every single day due to this user-hostile design. Also for most phones it's trivial to change the IMEI to resell the phone, or simply part it out. Which sure, are more things manufacturers see as bugs, to the frustration of legitimate activity - hence Right to Repair. The majority of the world is honest. Let's not build ourselves into a prison just to fallaciously protect against the few who aren't.
  - derefr 6y ago
    > I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Errr, to be clear, the reason that phones don’t get stolen is that there are anti-theft measures in place. People steal similar types of item (e.g. car stereos, game consoles, Blu-ray players) all the time. There’s no reason other than anti-theft measures that phones as a type of item would be stolen any less than these other categories. (They’d actually be stolen far more, since they’re small/easy to slip into one’s clothes/not a weird thing to be carrying around; and are often found just left on tables at cafes or hanging out of people’s back pockets. They’re like cash, basically.) It’s the same reason that people steal bicycles more often than they steal cars. Bicycles, despite being worth much less, are just much easier to steal. > The majority of the world is honest. Do you live in a city? I’ve had my bicycle stolen five times now. I’ve also been mugged twice. I’ve never had my phone stolen, though—because it’s worthless to the sort of dumb criminals who steal things just to hawk them on the street, rather than to fence them. It doesn’t require a large fraction of the world to be dishonest, to result in most people in the world having crimes committed against them. A thief will steal from far more than one person in their thieving career. Especially in regimes where the computed ROI for going after certain types of thief (e.g. homeless, drug-addicted thieves) is negative (i.e. their prison housing costs society more than their thieving does, apparently), and so they’re never held for more than a day or two.
    - 6y ago

toast0 6y ago

It might make things difficult for emergency calls without a SIM? It's been a while since I looked at protocol spec around that, I don't know if you can get a TMSI without an IMSI, if you can, things would probably be OK as long as two phones didn't turn on and access the same tower at once.

stefan_ 6y ago
It's like the MAC address of your smartphone WiFi radio. Yes, you'll get problems if there are two identical ones in the same cell, but in practice randomizing the MAC works perfectly fine.
- yuubi 6y ago
  Except not. The MAC-layer identity in LTE is the RNTI, which is temporarily assigned by each cell before the mobile transmits any sort of unique ID.

Klinky 6y ago

Because SIM identifies subscriber, and IMEI identifies equipment. They are not the same thing.

derefr 6y ago

Anti-theft. The device itself needs an identifier, so that if someone steals your device—immediately turning it off, re-flashing the OS, and putting their SIM in it, before booting it back up—then the network will still have some identifier to recognize the device itself by, so that it can say “nope, that’s stolen” and refuse to let it onto the network (thus disincentivizing stealing cellphones in the first place.) I believe network-IMEI-registration isn’t the primary mechanism by which modern phone anti-theft works by, though, since the device-owner is free to change the phone’s network-reported IMEI (much like you can change an Ethernet controller’s network-reported MAC address.) I might be wrong here, though; the phone’s baseband might come up with its burned-in IMEI and check for validity with the server, before switching to any application-processor-requested IMEI. (You can get around that by just booting up the phone in a Faraday cage—but having to do that every time would definitely decrease the black-market resale value.) For iOS, at least, I think the anti-theft works by getting onto wi-fi each time the SIM changes and asking some activation server about the validity of [some other internal static device-ID that can’t be tampered with in this way]. Not so sure what, if anything, Android does (Android’s case is harder, since for phones with an unlocked bootloader, you can always flash an altered firmware that has no anti-theft logic.)

mindslight 6y ago
The same anti-theft argument could be used to justify building surveillance tech into any object, and yet our society seems to function just fine without it. I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Yet we all get tracked every single day due to this user-hostile design. Also for most phones it's trivial to change the IMEI to resell the phone, or simply part it out. Which sure, are more things manufacturers see as bugs, to the frustration of legitimate activity - hence Right to Repair. The majority of the world is honest. Let's not build ourselves into a prison just to fallaciously protect against the few who aren't.
- derefr 6y ago
  > I've never had my phone stolen, and I don't know anybody who has even just lost their phone more than once. Errr, to be clear, the reason that phones don’t get stolen is that there are anti-theft measures in place. People steal similar types of item (e.g. car stereos, game consoles, Blu-ray players) all the time. There’s no reason other than anti-theft measures that phones as a type of item would be stolen any less than these other categories. (They’d actually be stolen far more, since they’re small/easy to slip into one’s clothes/not a weird thing to be carrying around; and are often found just left on tables at cafes or hanging out of people’s back pockets. They’re like cash, basically.) It’s the same reason that people steal bicycles more often than they steal cars. Bicycles, despite being worth much less, are just much easier to steal. > The majority of the world is honest. Do you live in a city? I’ve had my bicycle stolen five times now. I’ve also been mugged twice. I’ve never had my phone stolen, though—because it’s worthless to the sort of dumb criminals who steal things just to hawk them on the street, rather than to fence them. It doesn’t require a large fraction of the world to be dishonest, to result in most people in the world having crimes committed against them. A thief will steal from far more than one person in their thieving career. Especially in regimes where the computed ROI for going after certain types of thief (e.g. homeless, drug-addicted thieves) is negative (i.e. their prison housing costs society more than their thieving does, apparently), and so they’re never held for more than a day or two.
  - 6y ago