1/19/2026 at 9:45:43 PM
Many years ago browsers started alerting users to HTTP (vs HTTPS) connections and HTTPS sites using invalid or untrusted certificates.How is it possible that in 2026 we're not notified by default when we connect to a cell tower with no certificate so our communications is being broadcast into the air completely unencrypted?
by zugi
1/20/2026 at 1:28:02 AM
>How is it possible that in 2026 we're not notified by default when we connect to a cell tower with no certificate so our communications is being broadcast into the air completely unencrypted?5G added that with Subscription Concealed Identifier (SUCI), but it's still optional. Certificates also don't work because you need to be able to roam, and doing certificate management for every carrier on earth is fiendishly hard. Not to mention that it's not feasible to hide IMEI before authentication could begin, imagine hiding IP or MAC addresses before a connection can be established, for instance.
by gruez
1/20/2026 at 1:49:13 AM
All of these problems have been solved on the web and there are many more websites and user agents in the ecosystem.Certainly, there are other market forces at play. Certainly carriers refusing changes and refusing to let a 3rd party authority sign their certs.
by smashed
1/20/2026 at 1:55:07 AM
>All of these problems have been solved on the webHave they? The solution to IP addresses is basically "use a VPN", which you could do also on a phone. SNI leaks have been around since forever, and despite eSNI, still isn't close to being widely fixed. There's MAC address randomization, but only because LANs and wifi networks are basically an unregulated free for all, so spoofing doesn't really matter. It's far less viable with controlled access networks like cellular. Some countries even have regulations banning spoofing/changing IMEIs.
by gruez
1/20/2026 at 4:41:31 AM
They haven't been solved on the web. Mobile phones have to authenticate themselves with the carrier to ensure someone is paying for their connectivity. Therefore they can't be anonymous. On the other hand, indeed, most of the time you don't have to identify yourself to connect to a web server — but once you have connected, you may face a paywall that requires authentication! Also, you are certainly authenticating yourself somehow with your ISP for your home internet connection.by TazeTSchnitzel
1/19/2026 at 10:09:03 PM
You're asking why a government, that is already known for massive surveillance, wants devices that nearly 100% of the population owns to be completely unencrypted?by shimman
1/20/2026 at 6:09:13 AM
Said government isn’t too keen on its own employees being vulnerable in this way, so it’s not as cut and dry as you make it out to be.Hanlon’s razor applies here.
by catlifeonmars
1/20/2026 at 1:21:35 AM
There's no indication government is behind this and given that Google is rolling out tools now to protect against it this was probably always doable and just never prioritized.by tootie
1/20/2026 at 1:29:03 AM
That's a just incredibly naive.by bflesch
1/20/2026 at 1:57:37 AM
It's observable facts. They are rolling out the features now. So what changed in 2025? Is the present government more liberal than the past? Clearly not. More like this kind of feature will be ignored and irrelevant for 99% of users.by tootie
1/20/2026 at 3:38:43 AM
relevant lesser known fact - 3G crypto is broken. In such a way that is a bit suspicious - a couple terabyte-sized rainbow table will crack it.I found a guy with the tables at one point, it's buried deep on the internet -- but this for example -- https://ieeexplore.ieee.org/document/6645525
by betty_staples
1/19/2026 at 10:43:27 PM
should'nt you always assume your communications are being broadcast into the air unencrypted unless you're connected with ssl/tls? even if encrypted to the tower the carrier can still intercept all your stuff.by globalnode
1/20/2026 at 2:32:25 AM
Unless your device is fully air-gapped, and you are absolutely certain of that, then you should assume whatever you do on the device is being monitored, by someone, somewhere, for any reason at all.by leptons
1/20/2026 at 12:24:29 AM
True, but multiple security layers help both through redundancy and because they protect different things.Cell encryption is not end-to-end, so even with cell signal encryption I'm susceptible to snooping by:
- the phone company
- the government if they serve the cell phone company with a warrant or other legal proceding
- malicious downstream actors
I'll use HTTPS for browsing to mitigate the damage of course, but even so without cell signal encryption, I'm susceptible to all of the above, plus any physically nearby actor can:
- see my text messages and possibly inject fake messages
- hear my phone calls
- see which IP addresses I'm communicating with (though not the contents of that communications if I'm encrypting with HTTPS)
- If app store security is inadequate or has flaws, they could force-feed me a malicious app disgused as an "update".
- I don't control the communications used by individual apps, so they can see any data passed in the clear, and trigger and exploit vulnerabilities in those apps via MITM.
So cell signal encryption helps a lot, though certainly it's not sufficient by itself.
by zugi
1/20/2026 at 1:41:01 AM
> the government if they serve the cell phone company with a warrant or other legal proceedingsThe police may have to sometimes jump though a couple of rubber stamped hoops, or hand over stacks of taxpayer money to companies for access to their online law enforcement portals, but the government is already inside taking everything that passes through those companies, using hardware those companies have been forced to install and/or by the outright seizure and occupation of their private property. There's nothing constitutional about it, but this has been true for a very long time (https://en.wikipedia.org/wiki/Room_641A) and it's not going to change.
by autoexec
1/20/2026 at 8:37:02 AM
Maybe we should just treat the pipe as insecure and focus on encrypting the app layer.Voice calls and SMS are presumably getting less and less popular.
by bdavbdav
1/20/2026 at 1:38:46 AM
WiFi still lacks forward secrecy, and SNI is still almost never encrypted.I think at least the former is intentional.
by sneak
1/20/2026 at 5:13:30 AM
WPA3 adds perfect forward secrecy.by BenjiWiebe
1/19/2026 at 10:09:18 PM
The moment this is rolled out is the moment government will start figuring out how to insert itself into the chain of trust so it will not matter.by Muromec
1/19/2026 at 10:36:24 PM
Why bother locking the door if it can be kicked down? /sThe harder and obvious it is, the better.
by Avamander
1/19/2026 at 11:27:22 PM
Because the door being open makes it possible for opportunistic thieves and even kids to steal something. If the police knocks on it, it's actually better to open it. Otherwise they will still get in, but you will also not have door after that.With phone interception, I can't imagine any other actor being sophisticated enough to bother with setting up the stringray thingy. Maybe something very targeted to get somebody very special (having a hot wallet with 20 bitcoins and going around the city with it comes to mind), but I would still expect the simplier methods there too.
Add: Even with the normal HTTP traffic, mitming was way more common and more practically exploitable back in the day, just by setting up a rogue wifi AP and fishing for passowrds. I'm not sure it was ever a thing with stringrays when non-government actors did something with them.
by Muromec