Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are SIM cards still a thing?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 191 posts

Re: Ask HN: Why are SIM cards still a thing?

#91

Post by informatimago »

The software equivalent would be a TEE (Trusted Execution Environment), but it relies on hardware support. Only a few arm processors and a few Android phone support this option. Apple has its secure enclave, but you cannot download trusted application in it, only Apple can do that.

A 100% purely software solution can be built based on white box encryption. It's slower and may be more easily attacked than a hardware protection (you never know if/when some genius mathematician or physician (quantum cryptographic attacks) breaks your encryption. But it has the advantage that it can run on all devices. cf. eg. https://www.trustonic.com/solutions/trustonic-hybrid-protect...

Then of course, there's the problem of key management and distribution thru software. Using a physical token has several good security properties. Replicating them in software (encryption) is difficult and error-prone. For end users, and service provides, it's much easier to swap a SIM card, than to install securely cryptographic keys and authentication tokens into his trusted execution environment even with the help of well written software.

Re: Ask HN: Why are SIM cards still a thing?

#92

Post by wolfgke »

wyldfire wrote: post #79
kalleboo wrote: post #40

The actual reason it's still a thing is because changing how thousands of network operators work in over 200 countries is quite difficult to coordinate. Even Apple tried to push a soft-SIM and couldn't get it going. But I'm glad for it, because the foresight of the designers of GSM to put your private key in a smartcard has absolutely improved consumer choice worldwide. I can buy an unlocked phone, travel to any coun…

IMO the fact that the device subsidy is so popular with both consumers and network operators in the US means that all of this ostensibly anti-consumer stuff will be with us for a while. The (hard) SIM cards don't even offer the desired portability if you have to go beg for the device to be unlocked.

> The (hard) SIM cards don't even offer the desired portability if you have to go beg for the device to be unlocked.

It's not the SIM card that is not portable, but the phone that you bought.

Re: Ask HN: Why are SIM cards still a thing?

#93

Post by trprog »

>Feels like this is probably the result of telco networks wanting as much friction as possible to change providers

I don't understand how you came to this conclusion.

I move between networks very regularly due to frequent travel to different countries. Pulling out your old sim card and putting in a new sim takes maybe 2 minutes. You are then immediately off your old network and on the new network. Once you have the sim in your possession you don't need to talk to anyone, fill in any details, log into anything or even remember anything.

Short of some process that is 100% automatic I can't imagine a more low friction process.

Re: Ask HN: Why are SIM cards still a thing?

#94

Post by wolrah »

aminorex wrote: post #86
kuschku wrote: post #83

Earlier quoted context omitted.

Runs java, it has its own smartcard processor. SIMs are smart cards in the exact same way as your NFC-enabled credit card, or other cards, and many systems use the SIM to store payment data actually. Android Pay could do exactly that, too – but doesn’t, because one US network prevented them from storing that on the SIM, so instead it’s stored in normal memory, which led to safetynet, which led to Android phones being…

Name the culprit.

If it's a US cell provider being shitty and restricting technology, it's got to be Verizon.

They hate anything that isn't under their control.

There are way too many people in the US who think Verizon is their only option because they haven't tried other providers in a decade.

Re: Ask HN: Why are SIM cards still a thing?

#95

Post by gergles »

wolrah wrote: post #94
aminorex wrote: post #86

Earlier quoted context omitted.

Name the culprit.

If it's a US cell provider being shitty and restricting technology, it's got to be Verizon. They hate anything that isn't under their control. There are way too many people in the US who think Verizon is their only option because they haven't tried other providers in a decade.

It was indeed Verizon.

Re: Ask HN: Why are SIM cards still a thing?

#96

Post by pYQAJ6Zm »

rocqua wrote: post #81
jlgaddis wrote: post #34

As others have pointed out, SIM cards are basically smart cards. There's PKI, private keys, the ability to perform mutual authentication (although that's not usually done, at least in .us), and much more. Honestly, I wish their use would expand into other areas of our lives -- replacing username and password combinations for various devices (working for an ISP, home routers are one good example). As much as I'm again…

Sadly, encrypting e-mail will break all current anti-spam methods.

An intermediate solution?: All encrypted email senders have to be while-listed by the receiver. All clear email will be allowed by default, and usually be the first way of reaching somebody, either for legitimate or illegitimate (spam) purposes.

Re: Ask HN: Why are SIM cards still a thing?

#97

Post by another »

Strom wrote: post #55
mherrmann wrote: post #50

Earlier quoted context omitted.

I have hundreds of usernames and passwords for various web sites and don't see a problem in having one more(?)

If you use actual strong passwords then you are an outlier. Most people use basic words like "password" as shown by every password dump in history. Indeed, most people would use the very same weak password they use for their e-mail for their mobile, and this would reduce protection against spoofing versus continuing to use the SIM system. What we need is a SIM-type system on the web as well, not to bring the broken w…

Furthermore, any security system that effectively relies on the user possessing more than one computing device (e.g., using your laptop for access to a password manager or email address) fails for the significant and increasing swath of humanity for which their phone is their [first and] only such device.

Re: Ask HN: Why are SIM cards still a thing?

#98

Post by RandyRanderson »

trprog wrote: post #93

>Feels like this is probably the result of telco networks wanting as much friction as possible to change providers I don't understand how you came to this conclusion. I move between networks very regularly due to frequent travel to different countries. Pulling out your old sim card and putting in a new sim takes maybe 2 minutes. You are then immediately off your old network and on the new network. Once you have the s…

I and I suspect a lot of other ppl do change sims becuse of high roaming fees. In that case there is some paperwork involved, some cash and more than 2 minutes.

I think he's contrasting this with soft-SIMs, where there's no physical sim to switch (maybe an app, provided by the manufacturer) and theoretically no cash required.

Re: Ask HN: Why are SIM cards still a thing?

#100

Post by shshhdhs »

anlif wrote: post #47
Strom wrote: post #39

Earlier quoted context omitted.

In Estonia, you can use your SIM to create a government recognizeed digital signature. [1] Thus, you not only identify yourself to the mobile operator, but you can also identify yourself to banks, government services, and more. [1] https://e-estonia.com/component/mobile-id/

The same idea is used in Norway. Most banks and public services (e.g. tax returns) use this system for online two-factor authentication. [1] https://www.bankid.no/en/

Didn't NIST just say two factor via mobile is a "bad idea"? Have Norway or Estonia responded?

EDIT: Thank you whoever downvoted an honest question that added to the discussion

Post reply on HN