Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Living without a SIM card

habd.as

Post reply on HN
Print view View original

71–80 of 300 posts

Re: Living without a SIM card

#71

Post by kiloreven »

wtmt wrote: post #40
kiloreven wrote: post #32

Earlier quoted context omitted.

The BanID SIM-application has to be installed over the air and activated through online banking. It's bound to one physical SIM, so an attacker would need to get into the online banking in the first place to reinstall the SIM app onto the new card. I believe the auth keys are stored on the SIM as part of this solution, and regenerated every time it's reactivated, invalidating the existing SIM.

How does this actually work on something like iOS, which I believe is a lot more restrictive and may not allow access to the SIM except through carrier services (which are in turn susceptible to attacks, including bribes, social engineering, etc.)?

The carrier is involved in transmitting and triggering the challenge as well, and I'm pretty confident that it works on iOS, though I've never tried myself.

The authentication works like this:

1. User fills out form with enough public and semi-private infoemation to securely identify the user (usually phone number and date of birth or social security number) 2. The user is presented with a random two-word string 3. The same message appears on the user's phone. If the words are the same, the user proceeds to input a PIN. The PIN is only stored on the SIM, and is chosen by the user. 4. A response is sent from the phone and the user gets logged in.

I assume that the challenge response employs asymmetric authentication, storing a private key for the SIM and public key for BankID on the SIM.

I'm not familiar enough with how the underlying crypto works to guess what kind of attacks they'd be suceptible to, but considering that the authentication is used for most public services in Norway (including taxes, welfare, medical records and document signing) as well as some private services (banking, insurance), I'll believe that the proper due diligence has been done.

There is a big focus on using these platforms securely, and BankID recently ran an at campaign with some TV spots, telling how people should never share their BankID login, not even with their loved ones - https://youtu.be/OFJmX7A--w4

Re: Living without a SIM card

#72

Post by Ayesh »

pjc50 wrote: post #25
torh wrote: post #19

Without a SIM card it would be a lot harder to do my taxes, access my online bank, check my insurance, etc., because the SIM card is used to veriy my identity using a solution called BankID. ( https://www.bankid.no/en/company/ ) It's a lot easier then the alternative with OTP codes, especially since BankID is now supported by a lot of different sites and services. From government, banking, phone companies, etc.

How has Norway solved the "slamming" problem, where attackers ring the phone company and get a duplicate SIM?

Not sure about Norway, but in the Netherlands, you have to note down the PUK code. You can't get a replacement SIM card without PUK code. This is for prepaid though.

Re: Living without a SIM card

#73

Post by Shalle135 »

kiloreven wrote: post #32
pjc50 wrote: post #25

Earlier quoted context omitted.

How has Norway solved the "slamming" problem, where attackers ring the phone company and get a duplicate SIM?

The BanID SIM-application has to be installed over the air and activated through online banking. It's bound to one physical SIM, so an attacker would need to get into the online banking in the first place to reinstall the SIM app onto the new card. I believe the auth keys are stored on the SIM as part of this solution, and regenerated every time it's reactivated, invalidating the existing SIM.

In Sweden the banks issue the BankID instead, the certificate is tied to the phone/pc it’s downloaded to and is not connected to the phone# at all. You can however connect for example ”Swish” to your bank accounts for seamless transactions through youe phone# but it too has to be authenticated with bankid.

I’ve never really heard of a case when the bankid/authentication to any Swedish banks has been compromised with the exception of the users signing in fraudulent actors.

Re: Living without a SIM card

#74

Post by Fnoord »

njitbew wrote: post #11
goblin89 wrote: post #10

> …it's the only thing which has prevented me from having to continually make international calls from a friends phone By relying on other people it is possible to do without many things. However, unless you have other ways of signaling sufficient status or wealth (such as being a digital nomad living abroad in a lower income country), people you continuously rely on for essentials might start treating you with a lit…

My sister’s former boyfriend used to carry a phone without a SIM. His mom ended up calling my sister or our landline to check up on her son. It was annoying AF. Feel free to live off the grid, but please make sure you don’t leech off of those around you.

He could've just used a SIP client (plus e.g. WLAN, which does not even have to be on 24/7), and being the one who initializes the call. If he does it on a sane time, then he'll reach contact.

Re: Living without a SIM card

#75

Post by neilkakkar »

nicky0 wrote: post #29
neilkakkar wrote: post #3

Not trolling: How does your life feel different knowing your data is not being stored in some database? Losing out on all those conveniences sounds miserable to me.

Some of us struggle with having constant connection to the internet in our pocket. Its a distraction at its mildest, and an damaging, health affecting addiction at worst (social media, and 24/7 work/communication expectations especially). Well done to those of you who are able to carry around a smartphone and regulate yourselves but some of us need to take more drastic action to cut it out.

That makes sense, but wasn't mentioned as a core reason in the post, so I'm assuming it's not that for author.

Re: Living without a SIM card

#76

Post by Ayesh »

kome wrote: post #22
paper-boat wrote: post #15

I've also tried going SIM-less for a few years. Wifi hotspots are frequently around you rarely find yourself in a situation needing a data plan. But the main problem is 2FA many services force you to use now. Going without a data plan is wonderful, but every now and then, having a couple minutes are SMS services is great.

I lived SIM free basically all my adult life, but I had to buy a SIM last September, because a new European banking regulation that requires 2FA. SMS 2FA is a joke tho.

> SMS 2FA is a joke tho. Yes, everyone knows. But it's better than nothing.

Re: Living without a SIM card

#77

Post by ryukafalz »

Ayesh wrote: post #76
kome wrote: post #22

Earlier quoted context omitted.

I lived SIM free basically all my adult life, but I had to buy a SIM last September, because a new European banking regulation that requires 2FA. SMS 2FA is a joke tho.

> SMS 2FA is a joke tho. Yes, everyone knows. But it's better than nothing.

Not always. If the provider can be social engineered into granting you access to the account after proving access to that number then I’m not sure “better than nothing” is that solid.

Re: Living without a SIM card

#78

Post by RupertEisenhart »

Ayesh wrote: post #69
nmstoker wrote: post #58

One major advantage is the impact on phone battery life - partly because various services aren't repeatedly pinging over the mobile network (especially in "notspots"), WiFi tends not to burn through battery. And partly because it tends to change your behaviour to do more focused things (the phone isn't constantly trying to distract you as it often can't, so you don't then waste time and power on these distractions).…

You can always use the phone on flight mode (to turn off radio), and selectively turn on GPS, WiFi, Bluetooth, etc).

Flight mode is the only way of living

Re: Living without a SIM card

#79

Post by alltakendamned »

melling wrote: post #4

When I travel overseas, if I can’t get a cheap SIM and data plan, I’m living for days trying to find public WiFi. Colombia has lots of free WiFi in parks, for example. We should be doing this everywhere.

You can also get 2GB prepaid for 3 weeks for less than 2 USD :)

Re: Living without a SIM card

#80

Post by dannyw »

bryanrasmussen wrote: post #48
jakobegger wrote: post #27

Earlier quoted context omitted.

> make sure you don’t leech off of those around you I think that's a toxic attitude. Picking up the phone for someone else every now and then is really not a big of a hassle. Obviously I don't know the whole situation, but in general I do think that one should be ready to do such minor favors for another human being without calling them a leech.

I know someone who lives off the grid like this, they are also too cheap to ever pay their share of airbnb lodging (I will stay with someone else, oh you got it I come stay with you), too cheap to give a bit of scotch tape for taping up a box when clearing out their dead mothers house because they bought that tape for 2 euro, or finally too cheap to buy their own chewing gum when they have had all their other expense…

Sounds like they're just cheap; and the off the grid part doesn't necessarily have anything to do with it.
Post reply on HN