I agree. Vendors are perfectly happy to randomize MAC addresses when scanning for WiFi access points, but apparently not willing to use the same algorithm when connecting to the cell network. I get that it makes many things easier when you have a persistent unique ID, but it is by no means required to control access to the physical layer. You can just randomly generate a number, and then authenticate with actual credentials.

Indeed. There is no valid technical reason for IMEIs to be unique, except for already very tenuous anti-theft perpetuation which is really a very minor factor.

Not to forget the surveillance stingrays. They (and dragnet data fishing) become useless with rotating device identifiers.

Stingrays tend to capture both IMEI and IMSI. This is GSM, which is used by 99% of the world.

IMSI then can be taken to the carrier and the account holder details will be released by a warrant.

An IMEI (which in most countries it will be illegal to change/clone) only identifies the hardware.

So swapping SIMs between phones don’t help to do anything apart from identifying a number of phones that you have access to.

3/4/5G phones will always drop back to 2G if it sees a 2G service whilst 3/4/5G frequencies are jammed.

So you need to realise that phones by design are tracking devices, and stock up on those burner phones and never switch them on near your home :)

In truth though, it is not very difficult to get a hold of an IMSI that does not refer to you, via an anonymous SIM cards you can get a hold of a few different ways. And it is not very difficult to find the maintenance service menu of your phone and disable everything except 4G and 5G either. However, it is much simpler to just leave your SIM card at home and use other means of access :)

Not all phones have access to baseband controls, and I’ve never seen a “turn off 2G” option, but yes you can turn off 3/4G.

It’s easy to get a burner phone in some countries, but many you need a passport or government-issued ID to even get a prepaid SIM! Let alone a phone!

Governments really don’t like citizenry to be anonymous.

For example on my LG V30, I can go to the dialer and enter :

    *#*#4636#*#*

I can then go into "Phone info" and set the radio to "LTE only" or "LTE/WCDMA", and if there is no 2G/3G/etc... I will not be have any service. [1]

This also works for most android phones, with small exceptions.

[1] : https://ibb.co/JvZVHXF

Also there’s other ways of leaking your IMSIs, EAP-SIM and carrier wifi for example.

No idea yet how widespread the implementation is as I’m teaching myself all of this in my spare time!

EAP-SIM and Carrier WiFi is also not very difficult to disable. In any case, an IMSI leak is not as bad as an IMEI leak.

Also ... define “not difficult to disable” when it’s not exposed in the UI.

A *# code doesn’t count here also ;)

For me, not difficult to disable means that it takes less than 15 minutes to do so. difficult to disable would take hours and require specific knowledge.

I think you May have that backward. But why do you think this?

Because the IMSI is changed much more easily than the IMEI, and if in LTE only mode is only temporary.

Not all phones are android;)

Presumably someone that really cares about privacy would use an Android :)

If someone really cared about privacy, you’d not be using cellular technologies at all ;)

> 3/4/5G phones will always drop back to 2G if it sees a 2G service whilst 3/4/5G frequencies are jammed.

This is not always true. For example, Jio is an LTE-only network and phones are set to "LTE only". They will never switch to 3g/2g.

That’s one reasonably obscure network. As far as I can tell it’s Indian - if memory serves that country has no cryptography on their gsm networks and can demand keys at will. Even blackberry gave them access to their secure network.

And if the state has access, you’re one social engineering step away from the keys to the kingdom shrug

I think GSM security is less relevant than ever, specially in India. More and more people are using Whatsapp and Messenger instead of voice calls. SMS is literally non-existent. Since Whatsapp is end to end encrypted, the carrier/govt simply cannot look at the contents.

PS: I wonder why you'd call one of the world's largest LTE networks "obscure". Number of Jio users is probably comparable to entire population of USA.

> Jio, obscure to the western world, where Vodafone, T-mobile, Telefonica, and AT&T are fairly well known across the world. I get it’s the third largest carrier but is only serving the one country.

> GSM security, is everything. Getting the metadata of who you are and where you are, and being able to capture that passively is pretty sensitive metadata, I’m sure you’d agree.