2

When I go to SettingsMore...Mobile plan it gives me a message "{mobile operator} has no known provisioning website".

Digging into Android source code for WirelessSettings.java I found how URL gets populated (it was later moved to IConnectionManager but I guess it have similar implementation):

private String getProvisioningUrl() {
    String url = getActivity().getResources()
            .getString(com.android.internal.R.string.mobile_provisioning_url);
    log("getProvisioningUrl: mobile_provisioning_url=" + url);

    // populate the iccid, imei and phone number in the provisioning url.
    if (!TextUtils.isEmpty(url)) {
        String phoneNumber = mTm.getLine1Number();
        if (TextUtils.isEmpty(phoneNumber)) {
            phoneNumber = "0000000000";
        }
        url = String.format(url,
                mTm.getSimSerialNumber() /* ICCID */,
                mTm.getDeviceId() /* IMEI */,
                phoneNumber /* Phone number */);
    }

    return url;
}

So potentially it can create an URL like:

https:\\operator\provisioning.aspx?ICCID=8991101200003204510&IMEI=49015420323751&number=008801552341588

My question is, what such a provisioning site supposed let me do?

Is information passed to URL is sufficiently secure for a network operator to identify a customer so it can skip authentication?

1 Answer 1

2

To my understanding this functionality is to configure your current provider services such as offers, cheaper international calls, flatrates...

But I suppose you'd always have to login first. Just the those 3 things don't seem to be secure enough to just login with them.

1
  • Some providers have a special website which is only reachable via the mobile network's data connection. On that page I don't need any login or userdata, as it already knows from which mobile number I'm connecting.
    – mbirth
    Feb 15, 2017 at 0:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .