Re:The $24B Data Business That Telcos Don't Want to Talk About
by e12e on Tuesday October 27, 2015 @09:24PM
(#10462348)
I'm not sure how any of this will help, if there's a chance they can link the phone/router IMSEI[1] to your person in some way.
It's reasonable to assume, that any network provider will, for billing, internal use (eg: document/fight network abuse) and/or as mandated by data tracking laws store IMEI, MAC and IMSEI numbers, along with connection meta-data (tower, exact location if available, timestamp etc).
I don't think it's possible to get meaningful privacy from an attacker that either a) is your service provider, or b) works with your service provider (eg: NSA, buyers of data for "advertising")?
You could use TOR - but you'd have to use it for everything -- which pretty much rules out real-time voice/video chat AFAIK. Perhaps a VPN that crosses jurisdictions and corporate ownership would help against "commercial" attackers (eg: the ad networks). I'm doubtful how effective such a "single-hop" defense would be against state actors.
Not that I necessarily think all threat models should try to circumvent illegal government wieretaps - just pointing out that if that is wanted in addition to just un-linking meta-data on data/communication from meta-data/data on shopping/banking -- the needed security measures are likely to be inconvenient.
It's reasonable to assume, that any network provider will, for billing, internal use (eg: document/fight network abuse) and/or as mandated by data tracking laws store IMEI, MAC and IMSEI numbers, along with connection meta-data (tower, exact location if available, timestamp etc).
I don't think it's possible to get meaningful privacy from an attacker that either a) is your service provider, or b) works with your service provider (eg: NSA, buyers of data for "advertising")?
You could use TOR - but you'd have to use it for everything -- which pretty much rules out real-time voice/video chat AFAIK. Perhaps a VPN that crosses jurisdictions and corporate ownership would help against "commercial" attackers (eg: the ad networks). I'm doubtful how effective such a "single-hop" defense would be against state actors.
Not that I necessarily think all threat models should try to circumvent illegal government wieretaps - just pointing out that if that is wanted in addition to just un-linking meta-data on data/communication from meta-data/data on shopping/banking -- the needed security measures are likely to be inconvenient.
[1] https://en.wikipedia.org/wiki/International_Mobile_Station_E...