3 ms·

The IMSI. We don't do anything with the IMEI ourselves (it's in the category of hardware identifiers that I'm mentioning above). Some phones can change them whe

The IMSI. We don't do anything with the IMEI ourselves (it's in the category of hardware identifiers that I'm mentioning above). Some phones can change them when rooted, some can't. The network attach process doesn't use the IMEI inherently by spec, but some cell cores can query for it (for example, to block stolen phones). It's not a network identifier, and strange things sometimes happen with the IMEI that don't even affect connectivity -- https://www.androidauthority.com/duplicate-imei-vivo-india-1126928/ https://www.androidauthority.com/duplicate-imei-vivo-india-1...

jsmith45 4y ago
Which means that the tower owners that PGPP partners with could absolutely still track users based on the IMEI if they configure their equipment to always ask for it. (It won't work in some edge cases like duplicate IMEIs but those are not super common). They may not be doing it right now, but if this sort of thing catches on, it is likely that they will start trying to do it.
sneak 4y ago
> The network attach process doesn't use the IMEI inherently by spec, but some cell cores can query for it (for example, to block stolen phones). How widespread is this practice? Do the major US carriers know my IMEI? I tend to believe that they do from what I've seen in their web interfaces, and that IMSI rotation alone is basically pointless from a privacy standpoint.
- barathr 4y ago
  This is one of the problems with mobile -- there's isn't any one universally correct answer to this (or most questions), so I'll answer to the best of my knowledge. IMSIs are what are associated with your identity (because it's your SIM and service) in a normal mobile plan, and it's what was (is?) used by carriers when they aggregate / analyze / sell location data. IMEIs can be queried by a network core (not the tower) and US carriers probably do this every once in a while to check against their stolen phone database. It can be changed on some devices but not others. It's not inherently tied to you as a person but of course it is tied to that device. For those who don't need mobile data service of any sort, I think that PGPP Relay does what's needed -- decouples your IP from your identity -- and you can use WiFi networks without revealing anything.
  - sneak 4y ago
    > IMEIs can be queried by a network core (not the tower) and US carriers probably do this every once in a while to check against their stolen phone database. It can be changed on some devices but not others. It's not inherently tied to you as a person but of course it is tied to that device. It's also linked to the rotating IMSI, so all of the rotating IMSIs that are used at the times the IMEI is interrogated are linked together from a metadata standpoint. They're also all linked to every other IMSI that was ever used with that IMEI (at the times the IMEI is interrogated). > US carriers probably do this every once in a while to check against their stolen phone database Hourly? Daily? Monthly? Only on first-time seeing a new IMSI?
    - biktor_gj 4y ago
      Probably on every connect, there are ways to randomize your IMEI on every boot on certain phones though (that might be not very legal in some countries)
    - throwaway67743 4y ago
      Carriers globally check at registration time to deny stolen phones access (via various shared databases) etc, this has been the case for a long time and someone selling mobile services should know this.
  - throwaway67743 4y ago
    Please familiarise yourself with how cell networks actually work, you can't throw out comments like this because it's just not true.
    - NoImmatureAdHom 4y ago
      I know it's work, but...could you explain?
      - throwaway67743 4y ago
        If anyone else asked sure but I reviewed your comments earlier and I think it might be a lost cause.
throwaway67743 4y ago
I think you should clarify this, changing the IMEI in most countries is a criminal offence, do not keep brushing this topic off.
- ASHA77 4y ago
- NoImmatureAdHom 4y ago
  IIRC changing the IMEI in the U.S. is legal. It may go against standards or something, but that's not a crime (though it would be an excuse for a carrier to kick you off their network, should they find out). I would be shocked if there were real consequences for IMEI spoofing in the U.S. absent any crime (like stealing lots of phones and changing the IMEIs).
  - Handytinge 4y ago
    Luckily for the rest of us, the US is not "most countries", and makes up < 5% of the worlds population.
  - throwaway67743 4y ago
    Ok so I should have said in sensible societies because IMEI changing does cause real issues like lack of 911 (in this case), however the 3gpp spec that governs all networks and devices, like your phone, prohibits IMEI changing -its not an innocuous operation as people assume Edit: the FCC isn't specific about it but I'd imagine it falls under existing fraud regulations which may or may not be a federal thing. A cursory Google suggests: A bill was introduced in the United States by Senator Chuck Schumer in 2012 that would have made the changing of an IMEI illegal, but the bill was not enacted. So in the USA specifically it is not a crime but in many places it is due to the aforementioned life at risk issue. As devices are made for global .markets in general, the above does not apply anyway as you cannot change it without manufacturer tools anyway, at which point different regulation applies. IMEI changes also have limited effect when fingerprinting is relatively easy.

jsmith45 4y ago

Which means that the tower owners that PGPP partners with could absolutely still track users based on the IMEI if they configure their equipment to always ask for it. (It won't work in some edge cases like duplicate IMEIs but those are not super common). They may not be doing it right now, but if this sort of thing catches on, it is likely that they will start trying to do it.

sneak 4y ago

> The network attach process doesn't use the IMEI inherently by spec, but some cell cores can query for it (for example, to block stolen phones). How widespread is this practice? Do the major US carriers know my IMEI? I tend to believe that they do from what I've seen in their web interfaces, and that IMSI rotation alone is basically pointless from a privacy standpoint.

barathr 4y ago
This is one of the problems with mobile -- there's isn't any one universally correct answer to this (or most questions), so I'll answer to the best of my knowledge. IMSIs are what are associated with your identity (because it's your SIM and service) in a normal mobile plan, and it's what was (is?) used by carriers when they aggregate / analyze / sell location data. IMEIs can be queried by a network core (not the tower) and US carriers probably do this every once in a while to check against their stolen phone database. It can be changed on some devices but not others. It's not inherently tied to you as a person but of course it is tied to that device. For those who don't need mobile data service of any sort, I think that PGPP Relay does what's needed -- decouples your IP from your identity -- and you can use WiFi networks without revealing anything.
- sneak 4y ago
  > IMEIs can be queried by a network core (not the tower) and US carriers probably do this every once in a while to check against their stolen phone database. It can be changed on some devices but not others. It's not inherently tied to you as a person but of course it is tied to that device. It's also linked to the rotating IMSI, so all of the rotating IMSIs that are used at the times the IMEI is interrogated are linked together from a metadata standpoint. They're also all linked to every other IMSI that was ever used with that IMEI (at the times the IMEI is interrogated). > US carriers probably do this every once in a while to check against their stolen phone database Hourly? Daily? Monthly? Only on first-time seeing a new IMSI?
  - biktor_gj 4y ago
    Probably on every connect, there are ways to randomize your IMEI on every boot on certain phones though (that might be not very legal in some countries)
  - throwaway67743 4y ago
    Carriers globally check at registration time to deny stolen phones access (via various shared databases) etc, this has been the case for a long time and someone selling mobile services should know this.
- throwaway67743 4y ago
  Please familiarise yourself with how cell networks actually work, you can't throw out comments like this because it's just not true.
  - NoImmatureAdHom 4y ago
    I know it's work, but...could you explain?
    - throwaway67743 4y ago
      If anyone else asked sure but I reviewed your comments earlier and I think it might be a lost cause.

throwaway67743 4y ago

I think you should clarify this, changing the IMEI in most countries is a criminal offence, do not keep brushing this topic off.

ASHA77 4y ago
NoImmatureAdHom 4y ago
IIRC changing the IMEI in the U.S. is legal. It may go against standards or something, but that's not a crime (though it would be an excuse for a carrier to kick you off their network, should they find out). I would be shocked if there were real consequences for IMEI spoofing in the U.S. absent any crime (like stealing lots of phones and changing the IMEIs).
- Handytinge 4y ago
  Luckily for the rest of us, the US is not "most countries", and makes up < 5% of the worlds population.
- throwaway67743 4y ago
  Ok so I should have said in sensible societies because IMEI changing does cause real issues like lack of 911 (in this case), however the 3gpp spec that governs all networks and devices, like your phone, prohibits IMEI changing -its not an innocuous operation as people assume Edit: the FCC isn't specific about it but I'd imagine it falls under existing fraud regulations which may or may not be a federal thing. A cursory Google suggests: A bill was introduced in the United States by Senator Chuck Schumer in 2012 that would have made the changing of an IMEI illegal, but the bill was not enacted. So in the USA specifically it is not a crime but in many places it is due to the aforementioned life at risk issue. As devices are made for global .markets in general, the above does not apply anyway as you cannot change it without manufacturer tools anyway, at which point different regulation applies. IMEI changes also have limited effect when fingerprinting is relatively easy.