My mobile phone company has no idea who I am. It was trivially easy to purchase an iphone, at the Apple store, with cash and then purchase a Verizon MVNO SIM from US Mobile (which I prefer over StraightTalk because they allow tethering).
Neither Apple nor my MVNO nor Verizon knows who I am.
I, personally, am not a customer of any mobile provider.
Certainly my mobile provider could find out if they dug deeply enough - specifically, they could (somehow) check the Visa card I use for payment and see the corporation that that Visa card was issued to and then look up the corporate records and then ... they would know that somebody at X Corp is their customer. Possibly me.
Remember: neither Visa nor Mastercard verifies purchaser name. Only AMEX does this. You can purchase online with your personal or corp Visa/MC and put in "Mickey Mouse" as the name - it will always work unless they are a very, very rare merchant (usually European) that has put the "Verified by Visa" component into their workflow.
1. sample the HSS (HLR in old-money) every night to find which phones are camping in which location areas (LAC)s;
2. this given them a phone → area location for every phone in the country, where area is about 200 cells (a few km²);
3. then they could draw out the call detail_record (CDR) of very outgoing call, SMS, and even data session to get the cell identity;
4. this gets the phone → area mapping down to a few hundred m²;
5. then if they are motivated, they will use the location services in the Mobile Application Part (MAP) to silently move every unknown phone into dedicated mode and repeatedly determine its location to within 10m - 50m;
6. if the phone has control plane, GPS, they just ask it that. Many, many phones do;
7. this information is collected all the time and passed to in-house and 'external' GIS teams to cross-reference against all sorts of wonderful data;
8. they know who you are.
The good news is they don't care. They just want you to spend more. ARPU is everything.
Source: I built this stuff for a living.
My threat model is "telco or ISP employee decides to see if John is a customer and, if so, just what John does with his phone". They will not find me in their customer database and they'd have to dig fairly deeply, and possibly involve banks and/or LEAs which are not my threat model.
Also, just as a coincidence, and not by design, my place of residence has zero bars of mobile service ... I lose it about two miles from where I live ...
I'm sure that you've done better.
Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network. It isn't here yet but is coming.
Correct, but to clarify - they know your SIM cards location. In my case this correlates to a corp name and no actual personal name (mine or otherwise).
"Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network."
I suspect you are correct and I think this is already de facto practice for a consumer purchasing mobile phone service in the United States. I suspect, however, that an EIN and a corp name will continue to allow SIM provisioning without associated PII.
Something to consider: we are promised many, many more 5G SIM cards on the network than there are people on the planet. Most of those SIMs will be provisioned by corporate entities and, therefore, the ability to procure and deploy SIMs with no PII will persist ...
Remember, this isn't even new for many countries.
You may be able to do this in the US for the time being. However, in many countries already – a list that is steadily increasing – you cannot purchase a SIM card without showing ID, a copy of which is made and forwarded to state authorities. In other countries – I know of at least Chile – you may have to register the IMEI of the phone as well.
Are you paying with a pre-paid card? If not, your number is tied to your card which is tied to your identity.
Please correct me if I am wrong.
You can hide content, except where the sender is mirroring it. You can hide your DNS lookup by using a DNS aggregator (are you?), unless you are using 1.1.1.1 or something, where the business model is harvesting. But unless you route everything through a foreign VPN, the phone company knows what site you asked for a connection to.
And who owns that VPN, and what is their real business model? The bigger they are, the more their customer list is worth.
Unavoidably if you aren't using Tor the network can see the IP address, which would pin down that this is say, Facebook or Wikimedia, or Porn Hub. On its own you can't be sure this is Wiktionary not Wikipedia, or which type of porn.
In almost all cases the HTTPS traffic uses SNI (Server Name Indication) which deliberately carries the name of the server (the news.ycombinator.com in the URL you're looking at right now) in plain text. This enables Virtual Hosting - otherwise how would a bulk hosting company give you the certificate for bumsex.tinyblog.example rather than cats-in-boxes.example which are run by entirely different customers but hosted on the same cheap Apache server in a rack in Ohio? So that's enough to know it's the English language Wikipedia not Wiktionary or whatever.
But yes, it's only the site and so they won't know (at least just from this) if you looked up Bowel Cancer or Elizabeth Warren; if you are watching a Youtube video about Minecraft or Venezuela; and so on.
Medium term the plan is to deploy two technologies that mean the site's name isn't available, improving privacy. DPRIVE (encrypted DNS, often via DNS over HTTPS) and eSNI (Encrypted Server Name Indication) but while DPRIVE is complete and being rolled out (controversially as you may have seen right here on HN) eSNI isn't finished and is tricky to get right, it may be some years before you get much benefit. We need both for (hopefully) obvious reasons although DPRIVE already makes a lot of cheap censorship options impossible, and making censorship expensive makes it de facto unpopular in democratic countries where voters don't want to pay lots of money for something that seems mostly to inconvenience them. See also: popularity of the American TSA.
Even after all that work is done though, if the mere IP address you're connecting to is enough to be a problem you must use Tor today, and then, and likely forever.
Interestingly the Network described in Stephenson's "The Diamond Age" actually works exactly like Tor all the time, with (apparently) no way to directly send things to an address whatsoever. But this will always be more expensive to do with technologies we know about today, and so it is unlikely that we're destined to replace the Internet with a network that always behaves like Tor.