Easy to switch telco . Easy to change phone if one out of juice,i do find power bank kinda hassle sometimes to carry around and charge the out of juice phone
Ask HN: Why are SIM cards still a thing?
51–60 of 191 posts
Re: Ask HN: Why are SIM cards still a thing?
#52Earlier quoted context omitted.
Who would you want to hold your 'software SIM' username and password? What's to stop someone else from logging in to your account once they have your credentials?
I have hundreds of usernames and passwords for various web sites and don't see a problem in having one more(?)
Interesting. I try to keep the number of usernames and passwords I have to an absolute minimum because I don't trust any of those to keep that secret, nor do I trust my computer to not spill the secrets somehow through a browser bug or other drive by exploit.
At the same time I totally trust my sim, it's never been more than 10 meters away from me in the last decade or two, hasn't failed me even once and it would be very hard to get it to cough up its secrets without my cooperation (so rubber hose cryptography would still work).
Contrary to www security the phone system seems - from my perspective - at least to have done a half decent job at integrating 2FA when your average website - 20 years later - is still making up its mind about whether or not that might be a useful thing to add.
Re: Ask HN: Why are SIM cards still a thing?
#53Earlier quoted context omitted.
Because username and password is a disaster for security. It's sole purpose is let ANY guy ANY where on the planet connect to your account. SIM cards are cryptographic hardware tokens. They are much more secure than passwords. In fact, they do need a password as well on top of the hardware token, that's the 'PIN code' you have to enter when you (re)boot your phone.
Most of the internet runs on usernames/passwords. I understand that a hardware token (with a PIN) is more secure. But is it worth the added complexity?
> But is it worth the added complexity?
If you don't want your account to be hacked: yes.
Re: Ask HN: Why are SIM cards still a thing?
#54Earlier quoted context omitted.
Because username and password is a disaster for security. It's sole purpose is let ANY guy ANY where on the planet connect to your account. SIM cards are cryptographic hardware tokens. They are much more secure than passwords. In fact, they do need a password as well on top of the hardware token, that's the 'PIN code' you have to enter when you (re)boot your phone.
Most of the internet runs on usernames/passwords. I understand that a hardware token (with a PIN) is more secure. But is it worth the added complexity?
The SIM protects the carrier against "account sharing". It allows them to be sure that a subscriber is only using one phone at once - although it's portable between phones.
It means that carriers don't have to maintain "sessions" centrally. The SIM can authenticate you to the base station without the base station having to check back to see if you're logged in elsewhere - vital in reducing the latency of cell changes.
(It also stores various bits of technical information for SMS/MMS routing, and was intended to be a platform for "value added" applications.
Re: Ask HN: Why are SIM cards still a thing?
#55Earlier quoted context omitted.
Who would you want to hold your 'software SIM' username and password? What's to stop someone else from logging in to your account once they have your credentials?
I have hundreds of usernames and passwords for various web sites and don't see a problem in having one more(?)
If you use actual strong passwords then you are an outlier. Most people use basic words like "password" as shown by every password dump in history. Indeed, most people would use the very same weak password they use for their e-mail for their mobile, and this would reduce protection against spoofing versus continuing to use the SIM system.
What we need is a SIM-type system on the web as well, not to bring the broken web password system elsewhere.
Re: Ask HN: Why are SIM cards still a thing?
#56Earlier quoted context omitted.
Most of the internet runs on usernames/passwords. I understand that a hardware token (with a PIN) is more secure. But is it worth the added complexity?
The SIM protects the carrier against "account sharing". It allows them to be sure that a subscriber is only using one phone at once - although it's portable between phones. It means that carriers don't have to maintain "sessions" centrally. The SIM can authenticate you to the base station without the base station having to check back to see if you're logged in elsewhere - vital in reducing the latency of cell changes…
Account sharing in a telco context is a bad thing all around. Which phone would you like to ring? How do you ensure the charges really are made by (and to) the right person? How will you protect against messages with important information landing with the wrong party?
Authentication in a telco context is a good thing, the fact that the web doesn't have it enabled a large number of applications to flourish, it also made some other things devilishly hard, or even almost impossible.
Re: Ask HN: Why are SIM cards still a thing?
#57'eSIM' is on the way to replace sim cards. The biggest challenge of 'downloading a sim card' to a secure enclave on a phone is of course security. The GSMA and members (i.e. telcos) have been working on secure remote provisioning. I think it'll take a while for the technology to make it in to consumer devices, though it's likely to be used in IoT relatively soon. It takes a long time to spec these things up collabora…
Actually there is at least one company already offering Remote-Sim-Provisioning. https://medium.com/@ComfortWay_Glob/cwsim-freedom-of-connect... They are selling local data-plans abroad without switching the SIM card by implementing RSP. Calls are coming in 2017, also promising a portable phone number later that year.
another interesting company in this space is FlexiroamX, they have a super flat sim that sticks on top of your existing sim. It lets you soft-switch the SIM using a "SIM Application" (like mentioned elsewhere in the thread) - appears as if it unplugs and replugs to the phone.
See picture of the process here: https://twitter.com/lathiat/status/758979125751054336
Works fantastically and gives me $30/GB data in pretty much any country at often 4G speeds - with a 12 month expiry on the data (does cost $20 a year or something for 'membership' but still, usually costs far more than that for a sim starter pack in every different separate country you go to). Good for frequent travellers!
Obligatory please use my referral link if you signup :-) Bonus 100MB for both me and you. http://www.flexiroamx.com/referYXBBCJ / Code YXBBCJ
Re: Ask HN: Why are SIM cards still a thing?
#58Earlier quoted context omitted.
Because username and password is a disaster for security. It's sole purpose is let ANY guy ANY where on the planet connect to your account. SIM cards are cryptographic hardware tokens. They are much more secure than passwords. In fact, they do need a password as well on top of the hardware token, that's the 'PIN code' you have to enter when you (re)boot your phone.
Most of the internet runs on usernames/passwords. I understand that a hardware token (with a PIN) is more secure. But is it worth the added complexity?
There is no added complexity. Just buy a SIM card and put it in your phone. It is very simple and straightforward.
The alternatives are worse in usability AND security.
Re: Ask HN: Why are SIM cards still a thing?
#59I think it is more of a traditional security approach of "pairing hardware with hardware" and a case of "not fixing what is not broken" instead of making consumers suffer. It just works.
Fair assessment. I'd just like to be able to have a few SIMs loaded in software for travelling, given the typically extortionate roaming fees.
Re: Ask HN: Why are SIM cards still a thing?
#60The SIM card is a smart card, i.e. a secure piece of hardware, that protects the telephone network from the subscriber - most importantly, it ensures that the network has someone to bill. In most western countries, SIMs do little else; however, they are full application platforms, allowing stuff like Kenya's mobile payment network https://en.wikipedia.org/wiki/M-Pesa . For what it's worth, you really don't want to ha…
I hadn't thought about the security of being a physical token. Feels like you could do 2FA using someone's email (or similar) to protect against some scenarios, but take the point that someone having to steal something physical changes the attack surface.