Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Living without a SIM card

habd.as

Post reply on HN
Print view View original

31–40 of 300 posts

Re: Living without a SIM card

#31

Post by kickling »

torh wrote: post #19

Without a SIM card it would be a lot harder to do my taxes, access my online bank, check my insurance, etc., because the SIM card is used to veriy my identity using a solution called BankID. ( https://www.bankid.no/en/company/ ) It's a lot easier then the alternative with OTP codes, especially since BankID is now supported by a lot of different sites and services. From government, banking, phone companies, etc.

Is that the same as BankID in sweden? That is not 'connected' to the sim card, but to the device itself.

Re: Living without a SIM card

#32

Post by kiloreven »

pjc50 wrote: post #25
torh wrote: post #19

Without a SIM card it would be a lot harder to do my taxes, access my online bank, check my insurance, etc., because the SIM card is used to veriy my identity using a solution called BankID. ( https://www.bankid.no/en/company/ ) It's a lot easier then the alternative with OTP codes, especially since BankID is now supported by a lot of different sites and services. From government, banking, phone companies, etc.

How has Norway solved the "slamming" problem, where attackers ring the phone company and get a duplicate SIM?

The BanID SIM-application has to be installed over the air and activated through online banking. It's bound to one physical SIM, so an attacker would need to get into the online banking in the first place to reinstall the SIM app onto the new card. I believe the auth keys are stored on the SIM as part of this solution, and regenerated every time it's reactivated, invalidating the existing SIM.

Re: Living without a SIM card

#33

Post by llampx »

peterburkimsher wrote: post #12

I live without 3G on my phone, though I still have a SIM card for receiving "emergency" calls. I haven't topped it up though, so I can't call out. It's been wonderful to make me focus on face to face conversations with people, rather than checking notifications all the time. I ask them to add me on Facebook, or make a note of their email address. If I can get online, I use mbasic.facebook.com with no ads, which loads…

> I live without 3G on my phone

> My phone wakes me up with an alarm, but I'm not flooded with depressing Apple News first thing in the morning.

So you turn off wi-fi before going to bed?

Re: Living without a SIM card

#34

Post by testis321 »

Ayesh wrote: post #6

If saving money is the reason, go for a prepaid card. German/Dutch prepaid cards have far long credit life. I travel full-time nowadays and I can use my KPN number for less than €1 per year. German Alditalk credit lasts 24 months IIRC, and topping up extends the credit shelf life. Pretty much every SIM card has free incoming SMS when roaming. USSD are also free with some carriers. Losing SIM card is less of a hassle…

> Perhaps other than tracking concerns, I'm totally not convinced with the reasoning.

Tracking is not an issue, if you keep your phone in airplane mode (wifi and bluetooth can be enabled on most phones, but mobile network stays disabled), or if you just remove the sim card, and put it back, on those rare occasion when you need it (so you don't have to bother other people)

Re: Living without a SIM card

#35

Post by pjc50 »

kiloreven wrote: post #32
pjc50 wrote: post #25

Earlier quoted context omitted.

How has Norway solved the "slamming" problem, where attackers ring the phone company and get a duplicate SIM?

The BanID SIM-application has to be installed over the air and activated through online banking. It's bound to one physical SIM, so an attacker would need to get into the online banking in the first place to reinstall the SIM app onto the new card. I believe the auth keys are stored on the SIM as part of this solution, and regenerated every time it's reactivated, invalidating the existing SIM.

This is .. remarkably sensible, and a good example of using the secure elements of the SIM card for the intended purpose. Makes me wonder why more places don't do this.

Re: Living without a SIM card

#36

Post by Vinnl »

njitbew wrote: post #11
goblin89 wrote: post #10

> …it's the only thing which has prevented me from having to continually make international calls from a friends phone By relying on other people it is possible to do without many things. However, unless you have other ways of signaling sufficient status or wealth (such as being a digital nomad living abroad in a lower income country), people you continuously rely on for essentials might start treating you with a lit…

My sister’s former boyfriend used to carry a phone without a SIM. His mom ended up calling my sister or our landline to check up on her son. It was annoying AF. Feel free to live off the grid, but please make sure you don’t leech off of those around you.

This is really hard to do. I don't live off the grid by any means - there's a million ways to contact me, e.g. text message, calling, Signal messages, emails, etc. However, I don't use Whatsapp in a country where the vast majority of people does.

I'm fine with missing things if people don't feel like using any of the methods I have to get in touch with me. However, instead of either not bothering or using one of the communication channels we have in common, people tend to ask my partner to relay messages to me. So short of starting to use Whatsapp (which I'd really rather not do, and which requires installing a different OS on my phone - and possibly get a data subscription as well), the burden is on my partner to either tell them to contact me directly, or to relay the messages.

Any good tips for others ways of dealing with this are very welcome.

Re: Living without a SIM card

#37

Post by kwhitefoot »

kickling wrote: post #31
torh wrote: post #19

Without a SIM card it would be a lot harder to do my taxes, access my online bank, check my insurance, etc., because the SIM card is used to veriy my identity using a solution called BankID. ( https://www.bankid.no/en/company/ ) It's a lot easier then the alternative with OTP codes, especially since BankID is now supported by a lot of different sites and services. From government, banking, phone companies, etc.

Is that the same as BankID in sweden? That is not 'connected' to the sim card, but to the device itself.

Really?

In Norway BankID is quite definitely connected to the SIM card.

Re: Living without a SIM card

#39

Post by tjoff »

goblin89 wrote: post #30
torh wrote: post #19

Without a SIM card it would be a lot harder to do my taxes, access my online bank, check my insurance, etc., because the SIM card is used to veriy my identity using a solution called BankID. ( https://www.bankid.no/en/company/ ) It's a lot easier then the alternative with OTP codes, especially since BankID is now supported by a lot of different sites and services. From government, banking, phone companies, etc.

Isn’t BankID subject to the same old issues with cellular networks that make SMS 2FA insecure? Mobile provider support human factor, connection MITM’ing, etc. ( https://news.ycombinator.com/item?id=16810266 ) Edit: from sibling threads I can see that issuing a duplicate SIM card in Norway may require a very dedicated attacker, but mass-spoofing cell towers could still be an issue. I don’t know why do companies dislik…

Not at all. And the comment you link to is "just" social engineering. Tricking people into signing in someone else and then signing their transactions.

Akin to "hey I'm from paypal please give me your password so I can verify it is you". Or "I'm from Microsoft support, you have a virus please run this executable so that we can help you".

But it is a problem. And they explicitly target old and other people that (statistically) treat any computer stuff as black magic and are more likely to trust a stranger because they say they are calling from a bank/whatever.

Re: Living without a SIM card

#40

Post by wtmt »

kiloreven wrote: post #32
pjc50 wrote: post #25

Earlier quoted context omitted.

How has Norway solved the "slamming" problem, where attackers ring the phone company and get a duplicate SIM?

The BanID SIM-application has to be installed over the air and activated through online banking. It's bound to one physical SIM, so an attacker would need to get into the online banking in the first place to reinstall the SIM app onto the new card. I believe the auth keys are stored on the SIM as part of this solution, and regenerated every time it's reactivated, invalidating the existing SIM.

How does this actually work on something like iOS, which I believe is a lot more restrictive and may not allow access to the SIM except through carrier services (which are in turn susceptible to attacks, including bribes, social engineering, etc.)?
Post reply on HN