Conversation

if this is true. Then why the hell does rohde & schwarz sell imsi catcher that cost 100000+ to police. I understand that the carrier always knows where a phone number is located. But in germany you can still buy anonymous sim cards.

Quote Tweet

Nuttso

@Nuttso2go

Jan 25, 2019

Replying to @Nuttso2go and @DanielMicay

For example you are a journalist in some shady democracy and they decide to investigate you. Like to get your phone number. If you are with a burner number the telco doesn't have it tied to your name. So when they wan't to track you. They have to use an imsi catcher first

Replying to

In practice, most people use lots of unencrypted calls and messages. That's why I clearly recommended using encrypted calls and messages. It doesn't even need to be end-to-end encrypted to counter this. Transport layer encryption with pinning is more than enough to counter this.

Replying to

and

An 'anonymous' SIM card is not going to stay anonymous for long if you are actually being targeted. They can correlate it with your location and start tracking you directly once they've identified your phone. I don't understand why you think IMSI catchers are a counter to that.

Replying to

and

If they have access to the carriers, they can see which devices are active in your house or where they know you go, and then figure out which one is your phone. Local interception mostly serves the purpose of bypassing working through carriers, if they don't have that access.

Replying to

so this would only be used for unlawful tracking. But I got it. There is no real value adding this to the OS and lowering security with it.

Daniel Micay

@DanielMicay

Replying to

@Nuttso2go

They want those devices to intercept *unencrypted* data without getting warrants. In many cases, companies grant access without a warrant anyway. The solution is not sending / receiving sensitive unencrypted data. The carrier has access no matter what and likely logs it all.

10:21 AM · Jan 25, 2019Twitter Web Client

Replying to

and

They are often required by law to keep logs of call metadata and SMS metadata and content at a minimum, for a certain amount of time. They could keep more and can keep it for longer in most cases if they want. You are trusting the employees at that company, their partners, etc.

Replying to

and

If you're in a position where having the data intercepted locally is concerning, then you're already doing it wrong and should be concerned since the data is inherently visible to the carrier and anyone with access to their network. Law enforcement is one possibility among many.

Show replies