Hacker News Reader

The IMEI just identifies your phone. The IMSI identifies your number.

So it's perfectly possible to change the IMEI if you leave your IMSI alone. The network will think you just stuck your SIM in another phone. Everything will work fine. You can't change your IMSI as it's hardcoded on the SIM (technically you could with an eSIM but it simply would be unrecognised and just not work then).

Of course they still know who you are, and they need to to connect your calls. But apps that look at the IMEI for identification will be confused. Not sure how much it helps in terms of privacy. I doubt it helps a lot as any app can just make up a random number and dump it in their long-term storage to know it's you (just like a cookie).

And yeah the illegality of changing it is an issue in some countries. Also, if you 'clash' with another live IMEI weird things happen :)

PS: IMEI changing was outlawed in those days to stop people stealing phones and changing IMEIs to resell them and bypassing carrier blocks of the stolen phone. It was never that successful as thieves are lawbreakers by nature and don't care at all whether they break an extra law or two. Apple and Google's activation lock were much more successful. I'm personally not a big fan of laws when there are technical solutions that are equally or more effective.

AFAIK, a SIM card itself has a card id (ICCID), which should not be changed and is not used often. The subscriber id (IMSI) is in the "application" layer of the card and theoretically could be changed by the provider, or as a speciality, multiple ones installed.

That being said, I've never actually seen a card's IMSI changed. They usually give you a new sim and IMSI, even for a replacement card.

Most SIM cards are one-time programmable, so they can’t change anything on the card. They do still have a small RW area, but thats generally for user data (contacts).

You can get SIM cards that have large amounts of storage for running applets and have better support for OTA, but most carriers don’t like the extra expense.

Aren’t most SIM cards today use over the air provisioning since networks employ thin provisioning theses days?

Yes they do almost all support it (with many security vulnerabilities as a result, Karsten Nohl did a really great presentation on this at OHM2010). But the IMSI is almost always provided at manufacture time.

I think it's also because the card would not be able to be provisioned over the air without getting connected to the network first, and without an IMSI there is no network connection :)

> Whether you like it or not, Science stole your privacy the day you were born

I don't follow.

I think you have 3 paragraphs describing that the problem comes from irresponsible government agencies, entrenched private companies, and existing public infrastructure. But then you conclude that the reason GP can't have privacy is because science is in the way. I don't see how you got from point A to B.

> your best bet for some privacy is to limit your contact with other entities whilst also trying to change the laws for the better but as this requires interaction with other entities, it seems like you want a paradoxical situation to exist.

This is a somewhat strange way to think about privacy. Privacy isn't binary, and personal information isn't fungible. It's possible to reveal some information about yourself in some contexts, and then hide other information in other contexts.

Of course, lobbying is harder if you're trying to be private (heck, voting in the US is harder if you're trying to be private). But engaging with the system doesn't immediately mean you lose all of your privacy across the board. Yes, we do sometimes talk about privacy in bits -- but the full scope of privacy ultimately can't be represented by a single number in a math equation.

> How will your friends know its you calling if they dont recognise your number?

Apps could handle this sort of thing quite easily. The app itself could have its own ID (i.e. the username you use to sign into that service) and then that's what's presented to your friends and kept in their address books. You could change that whenever you wanted to as well (and then your friends would have to update their address books), but you wouldn't have to in order to change the other IDs, and that ID would only be used for that one service rather than allowing correlation between different services.

> To have a cellular network that allows random identifiers, you would need a system which accepts prepaid communication time

Not at all. If you wanted to change your IMEI, you would just have to give your carrier the new one, which could be an automated process. And your carrier could be a MVNO you trust not to share the correlation between your current IMEI and your account information with anyone. Meanwhile the towers then only have to know that that IMEI is authorized as a customer of that MVNO and send the bill to the MVNO.

But wait, is that changing the on-device IMEI, or just spoofing it when communicating with some random app?

I assume changing the device IMEI would have the same affect of directly spoofing it when connecting to mobile networks, which may be illegal; but If I leave all that alone, and only give a false IMEI to some random app, while connecting to mobile networks with the legitimate one, then what's the issue?

This is the way to do it for legally mandated identifiers like that. Only the baseband knows the actually IMEI, otherwise the OS just blanks it out or randomizes it, down to kernel calls.

Still isn't a very good solution, since you need to have a consistent identifier for some parts of networking to work, such as MAC addresses, IPs, bluetooth MACs, etc.

You can use software crypto keys to prove your identity.