81–90 of 191 posts
As others have pointed out, SIM cards are basically smart cards. There's PKI, private keys, the ability to perform mutual authentication (although that's not usually done, at least in .us), and much more. Honestly, I wish their use would expand into other areas of our lives -- replacing username and password combinations for various devices (working for an ISP, home routers are one good example). As much as I'm again…
Earlier quoted context omitted.
Doesn't every login form on the web also protect the respective operator from the subscriber? Why can't a "software SIM" simply be a username and a password? My explanation is that it's difficult to change something that literally the entire world uses.
Because username and password is a disaster for security. It's sole purpose is let ANY guy ANY where on the planet connect to your account. SIM cards are cryptographic hardware tokens. They are much more secure than passwords. In fact, they do need a password as well on top of the hardware token, that's the 'PIN code' you have to enter when you (re)boot your phone.
I transferred my mobile phone number etc over to a new SIM card the other week and all I needed was name, address, DOB and proof of ID... of course my network didnt have any of these on file yet, so I had to first tell them these details, and then show ID to verify that I was who I had just told them that I should be. Yeah... this is the state of consumer mobile security.
None of this required physical access to the phone, I just had to login to their website, with a username and password, and change my details.
On most networks you can steal someones mobile number with just a few minutes of physical access and a bit of planning.
Earlier quoted context omitted.
And it runs Java!
Runs Java or the phone runs Java code stored on the SIM?
SIMs are smart cards in the exact same way as your NFC-enabled credit card, or other cards, and many systems use the SIM to store payment data actually.
Android Pay could do exactly that, too – but doesn’t, because one US network prevented them from storing that on the SIM, so instead it’s stored in normal memory, which led to safetynet, which led to Android phones being less user-servicable than even Apple devices.
Earlier quoted context omitted.
I take the point on the security of physical + pin for protection. I guess I'd just love a solution where I could simply switch between accounts without physically swapping something or having a multi-SIM phone.
But why? Multi-SIM phones are cheap and easy to come by.
Earlier quoted context omitted.
Runs Java or the phone runs Java code stored on the SIM?
Runs java, it has its own smartcard processor. SIMs are smart cards in the exact same way as your NFC-enabled credit card, or other cards, and many systems use the SIM to store payment data actually. Android Pay could do exactly that, too – but doesn’t, because one US network prevented them from storing that on the SIM, so instead it’s stored in normal memory, which led to safetynet, which led to Android phones being…
1) One SIMs are a bit harder to tamper with than the OS of a phone which I am assuming would be the alternative to a SIM card i.e storing the same information on NAND flash accessible to the OS. SIMs have some threshold(it used to be 3) of unsuccessful attempts to read the card. A lock is activated and can only be unlocked entering the unlock code.
2) Carriers can talk directly to the SIM - A "SIM" is basically a Java applet that runs on UICC(Universal Integrated Circuit Card - the smart card itself.) I think a lot of people don't know that SIMs run Java - well Java Card. This mean that they can remotely lock a SIM card to prevent it from further accessing their network. If someone stole my phone or even just my SIM card I could call my carrier and they could lock the SIM remotely and consequently unlock it. They can also use the SIM to push new PRLs - preferred roaming lists. This is generally called OTA or over the air provisioning.
3)Convenience, if I use a pre-paid services with an MVNO or travel to another country and buy a pre-paid SIM while on holiday, I don't need to do anything else except insert the new SIM and power on the phone. What would the non-SIM card alternative look like? Its hard to imagine it being easier.
4)Carrier-locked phones, such as what you get when you are under contract to a carrier. The way phones are locked is by having the phone only accept SIMs from the carriers network. An unlocked phone will accept a SIM from any carriers network.
If anyone is interested this DEFCON presentation - "The Secret Life of SIM Cards", is pretty interesting:
https://www.defcon.org/images/defcon-21/dc-21-presentations/...
Quite a few years ago (2005?) a family member purchased a Samsung-branded dumbphone on a contract. (Monochrome LCD (something like 128x64?), polyphonic ringtones, 3 fixed games, a (really slow, GSM data) WAP browser; that was it. Model SGH-something, I vaguely recall.)
It had no SIM card slot. It was locked to the network (Orange - in Australia FWIW) via software. In order to unlock it we had to call up the telco and go through some process, which we decided not to do in the end (whatever it was, I don't recall), since the phone had less capabilities than the Nokias that flood India and similar places, so we concluded there was no point selling it by the time we dug it out one day and tried to figure out what to do with it. (It's still buried in a box somewhere IIRC.)
I think this is why SIM-less phones are reasonably rare - it's really, really hard to de-contract them, unlock them and put them into sellable (or whatever) condition. Then once you've done that the recipient has to go through some equally arcane process to get the thing linked to a plan/contract too. And considering the ability to pass a phone on is a fairly major selling point - phones aren't solely purchased [preconfigured] on plans, then disposed - I think this was explored somewhat by the industry but ultimately left alone.
Some of the other things I've found in this thread are really interesting, although I wonder how difficult it is to "unconfigure" such a device to sell or pass it on.
Earlier quoted context omitted.
Most of the internet runs on usernames/passwords. I understand that a hardware token (with a PIN) is more secure. But is it worth the added complexity?
The SIM protects the carrier against "account sharing". It allows them to be sure that a subscriber is only using one phone at once - although it's portable between phones. It means that carriers don't have to maintain "sessions" centrally. The SIM can authenticate you to the base station without the base station having to check back to see if you're logged in elsewhere - vital in reducing the latency of cell changes…
The SIM card is a smart card, i.e. a secure piece of hardware, that protects the telephone network from the subscriber - most importantly, it ensures that the network has someone to bill. In most western countries, SIMs do little else; however, they are full application platforms, allowing stuff like Kenya's mobile payment network https://en.wikipedia.org/wiki/M-Pesa . For what it's worth, you really don't want to ha…
If you have a credit/debit card with a chip, look at the arrangement of the contacts and compare to a SIM card. It's essentially the same standard (ISO 7816) at the lower layers, but with different application-layer protocols on top.
Also, as a matter of being the only device in posession of the subscriber but arguably owned by the telco, I'd definitely prefer it to be a removable piece which communicates over a standard interface. The alternative of embedding it into the handset is far worse from the perspective of lock-in and perhaps security.