Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The IMEI Code: Your phone’s other number

tedium.co

Post reply on HN
Print view View original

11–20 of 174 posts

Re: The IMEI Code: Your phone’s other number

#11

Post by spiesd »

I'm interested in the general thrust, but this article is sloppy at best.

> Check digit: The final digit is essentially used to validate the prior 14 digits with an algorithm. Similar digits exist in other types of identifier codes, such as the Universal Product Code (UPC) and the International Standard Book Number (ISBN). The algorithm that the mobile industry uses, the Luhn algorithm, is also used for social security numbers and credit card numbers.

No, just no. SSNs (in the US) don't have check digits.

Also:

> Then there are network identifier numbers—the MAC address bestowed upon you by your WiFi network or mobile provider

Huh? This nonsense ("bestowed upon") serves only to confuse. This is bad tech journalism: it fails to inform the masses, and is transparently worthless to experts.

Re: The IMEI Code: Your phone’s other number

#12

Post by londons_explore »

kevincox wrote: post #5
londons_explore wrote: post #3

The fact the IMEI is generally not editable seems like a massive privacy hole. Just let people edit it. Then I can be someone new every day and nobody can track me. Mac address randomization does that for wifi. Now do the same for mobile networks.

I really want mobile networks to accept their role as dumb data pipes. I should be able to just provide a password or certificate and connect. No IEMI, no SIM. And while we are at it stop tunneling my data back "home" when I travel. I don't want increased latency.

And while we're at it, how come if I have a phone without a sim I can't at least navigate to a carrier webpage to buy an esim?

The phone could pop up a menu saying "Here are the available networks", and you pick one, connect and it says "Welcome to AT&T, enter credit card number here", and you type a number and hit OK and you're connected.

Oh wait - just like Wifi!! Why are mobile networks so far behind?

Re: The IMEI Code: Your phone’s other number

#13

Post by kbolino »

kevincox wrote: post #5
londons_explore wrote: post #3

The fact the IMEI is generally not editable seems like a massive privacy hole. Just let people edit it. Then I can be someone new every day and nobody can track me. Mac address randomization does that for wifi. Now do the same for mobile networks.

I really want mobile networks to accept their role as dumb data pipes. I should be able to just provide a password or certificate and connect. No IEMI, no SIM. And while we are at it stop tunneling my data back "home" when I travel. I don't want increased latency.

How would a networking stack with no hardware addresses even work? The next hop needs a way to reach back to you, before you can negotiate anything fancy like passwords or certificates. Even IPv6 SLAAC starts with a hardware address.

Re: The IMEI Code: Your phone’s other number

#14

Post by londons_explore »

kbolino wrote: post #13
kevincox wrote: post #5

Earlier quoted context omitted.

I really want mobile networks to accept their role as dumb data pipes. I should be able to just provide a password or certificate and connect. No IEMI, no SIM. And while we are at it stop tunneling my data back "home" when I travel. I don't want increased latency.

How would a networking stack with no hardware addresses even work? The next hop needs a way to reach back to you, before you can negotiate anything fancy like passwords or certificates. Even IPv6 SLAAC starts with a hardware address.

rand()?

Re: The IMEI Code: Your phone’s other number

#15

Post by kbolino »

KenArrari wrote: post #6

If someone knows your IMEI can they track you?

Not from the other side of a wide-area network, but if they are continuously in close proximity to you, or can effectively monitor everywhere (three letter agency), then yes. Of course, there are other ways to track you.

Re: The IMEI Code: Your phone’s other number

#16

Post by xjay »

Android defaults to sending the IMSI (SIM ID) to Google.

> SUPL is used as part of the A-GPS (Assisted GPS) system to get a faster Time to First Fix. The problem is that Android's implementation automatically sends the IMSI (ID of the SIM card) to the SUPL provider for no apparent reason. And because Google is the default provider it's a big breach of privacy.

https://github.com/Magisk-Modules-Alt-Repo/supl-replacer

https://en.wikipedia.org/wiki/Assisted_GNSS

Re: The IMEI Code: Your phone’s other number

#17

Post by toast0 »

mytailorisrich wrote: post #8
londons_explore wrote: post #3

The fact the IMEI is generally not editable seems like a massive privacy hole. Just let people edit it. Then I can be someone new every day and nobody can track me. Mac address randomization does that for wifi. Now do the same for mobile networks.

There is no privacy concern, really, as this is unique to the device, not subscriber, and only shared with the network operator, who obviously already "tracks" the subscriber through the SIM , which contains the subscriber identifier (IMSI). On the other hand, the IMEI in principle makes tracking and disabling of stolen devices easy. By the way, in the UK it is actually an offence to change the IMEI [1] [1] https://w…

The IMEI also allows a network operator to track a device across multiple sims. And I think it's also shared with roaming operators if roaming happens.

Re: The IMEI Code: Your phone’s other number

#18

Post by kbolino »

londons_explore wrote: post #14
kbolino wrote: post #13

Earlier quoted context omitted.

How would a networking stack with no hardware addresses even work? The next hop needs a way to reach back to you, before you can negotiate anything fancy like passwords or certificates. Even IPv6 SLAAC starts with a hardware address.

rand()?

A MAC address is 48 bits and an IMEI is about the same entropy-wise. That's not nearly enough room to avoid duplicates (even SLAAC requires duplicate address detection, and IPv6 has a lot more bits to work with). You'd need a whole new layer 2 protocol, though to be fair you might be able to strip it down to just doing collision detection/avoidance and leave addressing up to layer 3 with IPv6, but that's not going to be any kind of backwards compatible or interoperable.

Re: The IMEI Code: Your phone’s other number

#19

Post by heilhippo »

BuildTheRobots wrote: post #2

Couple of thoughts > The combination of the ICCID and the IMSI basically tells the mobile network, “hey, this person paid for a plan.” As far as I remember, the ICCID never actually appears in standard network messaging. It might be possible for the network to request it, but it's not part of a standard 2/3/4/5g attach. The piece seemed to miss two major uses for the IMEI (or I missed it when reading), which were wor…

[dead]

Re: The IMEI Code: Your phone’s other number

#20

Post by soylentcola »

ementally wrote: post #4

You can use https://github.com/srlabs/blue-merle if you want to change your IMEI >The blue-merle software package enhances anonymity and reduces forensic traceability of the GL-E750 / Mudi 4G mobile wi-fi router ("Mudi router") >Mobile Equipment Identity (IMEI) changer >Media Access Control (MAC) address log wiper >Basic Service Set Identifier (BSSID) randomization >MAC Address randomization

Looks like it only works on their portable router (a separate device) unless I missed something. A sort of proxy for your phone I guess?
Post reply on HN