The thing is though, what they seemed to object to was trying to login (not using the same session cookie) across different IP addresses. At least that was the case when I opened the site on my laptop. Maybe my phone did login on the dodgy wifi and then when I reconnected via the 4g it tried to use that session, perhaps causing my account to be flagged. I'm not really convinced though.

It clearly makes sense to tie the session to the IP address but the 10 minute delay doesn't make much sense to me.

> It clearly makes sense to tie the session to the IP address...

At one point that might have been true but not any more. Mobile devices are the norm, and handoffs between cell towers and WiFi access points are handled transparently without any user interaction. Consequently, people expect their sessions to continue working despite changes in their IP address. Use TLS connections and set expiration times on the session cookies, but ignore the source IP address.

Your IP doesn't change per tower transition, your data from the tower goes through more centralized servers. For example my IP sitting physically in RTP in North Carolina is actually exiting AT&Ts network in Atlanta, Georgia.

For clean handoffs within the same network, sure. But you also have roaming to consider, and the device may lose its connection temporarily and be assigned a new address when it returns.

Is there actually any advantage to having a dynamic pool of IP addresses like this? Associating a number from your IP block to a subscriber number seems far, far simpler and better.

Locality/size of routing tables. If you had a hundred million subscribers with fixed IP addresses moving all over the country, you essentially could not aggregate any routes, but would have to have a hundred million routes in your routing table, and/or you would have to push all the traffic from and to all subscribers through one central router, which in particular would add latency for any subscribers that currenty are at the other end of the country.

If you’re suggesting each subscriber gets a static IP then that’s much worse for privacy.

I'm speaking from the provider's point of view: they don't care about privacy. In fact, in the US there is a federal law that requires them to be able to associate network activity with a subscriber at the request of law enforcement.

Your cellular traffic is proxied in most cases, and how carriers present it varies.

>In real life if the attacker is capable of stealing my session credentials the chance of them _not_ being able to tunnel through my local network is infinitesimal.

In real life each "trivial" filter like this cuts down a substantial number of potential attackers. Defense in depth. When there's a ton of hoops to jump through attackers go find a different target.

Nah, in real life it constantly batters the system administrators with unnecessary alarms who then stop taking them as seriously as they should be if they were actual attacks.