Comment by rootsudo | Hacker News Reader

Comment by rootsudo | Hacker News Reader

Parent Full thread

US IMEI's potentially are. They are recorded upon purchase - from carrier or reseller.

Sims same, they are immediately tied to your account and if you are post paid, there you go.

Anonymous cell phones also aren't entirely possible anymore because of network effect and the convenience factor.

1. Network effect, who you know, who you call, when they call you - pattern. 2. Internet usage, where do you go? 3. Geolocation - GPS, proximity with other cell phones, and then internal measuring devices. You can disable reporting completely, sure, but triangulation is user carrier side data, and with 5g roll outs and other potential signal repeaters and cell phones, it's still very accurate. 4. Sideline recording of this data is possible, same as a heat map in googlemaps - just looking for repeatable patterns of usage, where you go, etc.

It's not only hard, cell phones nowadays are not designed for anonymous usage. And this is before we even get into adtech, app tracking and other layers of interaction.

Of course, you need to put some effort into staying anonymous. Use it often enough and it's not hard to find out who you are.

But there is no ID requirement in the US. You can buy a SIM for cash, buy a phone for cash.

This is unlike many other countries. Singapore links all SIMs to your ID at purchase. There is a black market for anonymous SIMs (linked to random people's IDs), but the police actively crack down on those.

There is increasing demand for ID upon purchasing - and you are also forgetting that prepaid cell phone purchases must be activated at point of sale - which can trigger a CCTV snapshot from the terminal and record the method of payment.

Sure, you can "walk" to the store, browse to the phone aisle, pick up a prepaid phone, wait in line, ring out and pay in cash and walk out - but that all creates a foot print, geographically at a minimum.

You can try a smaller store, franchised sure - but there will be recording of the transaction. Then the activation itself. Then the recurring topping up of credits to use the service.

As with Singapore/Japan/Indonesia and China, yes - pre-activated sims still are sold w/ government intervention and seizing information and terminating the sim in use - but another thing to note is that the telecom in those countries are also state enterprises. In the USA, they are not - not yet.

But, "effort" into being anonymous, is friction - and the more friction you need to overcome, the more opsec you need to execute to maintain a hygenetic environment. That's where it becomes impossible to maintain.

Maintaining anonymity is hard, but similar to security, you can take steps to make it harder for your average police officer to use it against you.

State level actor? Well then yeah, you’re screwed.

"US IMEI's potentially are. They are recorded upon purchase - from carrier or reseller."

I have two phones - an iphone I purchased with cash at an Apple store and a Pixel 4 that I purchased from Amazon. My Amazon account is not connected to any individual person or personal address ...

The former IMEI ... recorded by Apple as "dude with cash" and the latter recorded by some fly-by-night Amazon third party seller as (dude with Amazon pseudonym) ?

"1. Network effect, who you know, who you call, when they call you - pattern. 2. Internet usage, where do you go? 3. Geolocation - GPS"

Yes - very appropriate to be thinking about these things and their impact on ones ability to pseudonymously participate on the mobile network.

I've been thinking of a raspberry pi access point that advertises a collection of SSIDs that exist elsewhere ... which is to say, I would record my network scan of unique SSIDs next time I am in downtown Denver and then recreate all of them in my office in San Francisco at the push of a button ... I wonder if there is a collection of SSIDs that would transport my phone to a different geography ...

IIRC Apple stores all do permanently stored facial recognition and capture.

> My Amazon account is not connected to any individual person or personal address ...

Except your card and the delivery address? Along anything other you ordered on this account?

Delivery address is not my home address and belongs to a corporation.

I mean, come on - that's like a "must be this tall to ride" minimum for these kind of efforts, right ?

Card number ... sure, if Amazon wants to break every single PCI compliance[1] (and many other) rule in the book and compare my un-hashed credit card number with (card numbers from other vendors and suppliers) then, yes, they could start to paint a picture there ... but in reality, nobody wants CC information - it's radioactive and there is no upside to storing/viewing/comparing it.

[1] https://www.rsync.net/resources/regulatory/pci.html

I have a cell phone, originally postpaid and purchase with cash. I didn't to out of my way to keep it anonymous, paid my monthly bill with a cc. No bank or credit card company I do business with accept it when they request a tell number. I conclude is flagged as not properly ID'd, just like a Google voice number is flagged as quasi anon.

That is not, thankfully, how that works ...

There are, indeed, non-mobile numbers and they are second class citizens with regard to shortcodes and SMS 2FA, etc. You will have difficulties, for instance, if you try to adopt a Twilio number (or similar) as your primary phone number.

But it has nothing to do with identification, per se - the most anonymous, cash-bought, found on the street SIM card is a real mobile number and will work perfectly ...

... and the most fully ID checked, personally identifiable VOIP number will work very poorly with 2FA (and not work at all with shortcodes).

I am not sure about your specific anecdote - what carrier are you using and is your "number" the number on your physical SIM card ?

Tel number was issued by Verizon, as a prepaid number and I supplied my own phone so I imagine the their number and their sim card so the the number should be on the Sim, no? This all happened about 6 or 7 years ago, they didn't ask for ID of any kind at the time.

Reply on news.ycombinator.com