Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Living without a SIM card

habd.as

Post reply on HN
Print view View original

151–160 of 300 posts

Re: Living without a SIM card

#151

Post by Aardwolf »

kiloreven wrote: post #56
Aardwolf wrote: post #49

Earlier quoted context omitted.

Why does this have to involve a SIM card though? Why not use the device itself, e.g. authenticator?

It's possible to use OTP and password as well, which requires a physical OTP generator. But that's actually more cumbersome than using the SIM alternative in my experience. I believe using the SIM adds layers of security that OTP apps can't compete with, including increased difficulty cloning the private key. I assume that accessing the relevant parts of the SIM is way harder and requires completely different vectors…

Since the early 2000's, banks in Europe gave physical OTP devices. While somewhat inconvenient if you don't have it with you, I still liked it better than alternatives that are popping up lately:

SMS based authentication, an app that generates a code from a QR-like pattern displayed on your computer screen (neat but they didn't think of the case where the screen displaying the QR pattern would be the phone itself, or the fact that you're letting their app see what else is on your computer screen) and paper cards with a finite amount of numbers on them.

In fact I'd prefer TOTP as supported by authenticator as a better phone based alternative since it's standard and you can control if and how you want to securely back up the codes rather than have a plethora of different systems.

Re: Living without a SIM card

#152

Post by lotsofpulp »

Joeri wrote: post #145
chewz wrote: post #129

I envy the OP. Unfortunately since September 2019 living without SIM card became (practically) illegal in EU. > most online payments above €30 to go through an extra level of verification such as entering a code received via a text message. [2] Most banks unwisely chosen SMS as Strong Customer Authentication providing little choice to customers. https://ec.europa.eu/info/law/payment-services-psd-2-directi... [2] http…

Banks in the US and EU are required to have the identity on file for all bank accounts (ostensibly to combat terrorism), so sharing your phone number with them shouldn’t change the level of privacy. If it is cost people are worried about they can get a prepaid card and never use it except to receive sms. That’s effectively free. Combined with the push to get rid of anonymous accounts and phone numbers there has also…

Since the inevitable conclusion is impossibility of being anonymous, I think we should push to ensure full transparency for all. Otherwise, it ends badly for those not in power.

Re: Living without a SIM card

#154

Post by thefounder »

chewz wrote: post #133
dangus wrote: post #131

Earlier quoted context omitted.

Unless you summarize the law we don't know what you mean by "practically illegal." When you say "practically illegal" I can only assume you mean "not illegal."

I have edited my answer. Most institutions I know have chosen SMS for Strong Customer Authentication which means sooner or later you in practical life will need your personal SIM card (banking, doctor visit, e-prescription, e-government etc.). Unless you chose to live off the grid for real.

sms is not PSD2 compliant which means it can't be used as SCA method

https://www.zdnet.com/article/german-banks-are-moving-away-f...

Re: Living without a SIM card

#155

Post by detaro »

chewz wrote: post #147
detaro wrote: post #142

Earlier quoted context omitted.

Where are you? Here in Germany, most banks do not require SMS (many have phased out SMS entirely).

In Poland most banks I use (Citibank, Santander, Millenium and others) require confirming logging into account via SMS at least once in two weeks. Some require confirmation via mobile app. (That wasn't obligatory before) Its rather that banks have phased out other methods like tokens as too expensive and troublesome. https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-... https://www.spidersweb.pl/2019/09/jak…

Even according to these articles, most support an app-based solution that doesn't require a phone number?

Re: Living without a SIM card

#156

Post by teddyh »

luckylion wrote: post #132
whorleater wrote: post #102

This is modern minimalism to its peak: getting rid of your stuff by relying on others

Wasn't that modern minimalism from the get-go?

It has been so ever since Thoreau lived at Walden Pond and waxed poetically of self-reliance and living alone, but had his mother take care of washing his clothes.

Re: Living without a SIM card

#157

Post by chewz »

dangus wrote: post #150
chewz wrote: post #133

Earlier quoted context omitted.

I have edited my answer. Most institutions I know have chosen SMS for Strong Customer Authentication which means sooner or later you in practical life will need your personal SIM card (banking, doctor visit, e-prescription, e-government etc.). Unless you chose to live off the grid for real.

But also, I think you have that situation understood the other way around. SMS was chosen because everyone has it already . So it's not a matter of being forced to have it, it's a matter of "all other alternatives are less widespread." I think there are actually more people globally with access to mobile phones than people who have access to basic sanitation, i.e. flushing toilets. I'm sure that many or most of those…

Yes but situation before September was that I could use my account without SIM card. Now access to my account requires having a SIM card and a phone.

Now imagine taking all my six SIM cards on vacation to Thailand just because you may be in need to urgently use one of my multiple bank or brokerage accounts ;-)

Re: Living without a SIM card

#158

Post by wolfgke »

hdkwowjdj wrote: post #52
Vinnl wrote: post #36

Earlier quoted context omitted.

This is really hard to do. I don't live off the grid by any means - there's a million ways to contact me, e.g. text message, calling, Signal messages, emails, etc. However, I don't use Whatsapp in a country where the vast majority of people does. I'm fine with missing things if people don't feel like using any of the methods I have to get in touch with me. However, instead of either not bothering or using one of the…

It's a social cost question, I guess. Your signal: I don't care enough about our communication to use WhatsApp, because of reasons that are obscure to 99% outside a tech community. Similarly, they don't bother to reach out to you on other communication channels, because they don't bother enough. The important thing to understand is, from your communication partners point of view, you create a burden without reason, s…

> The important thing to understand is, from your communication partners point of view, you create a burden without reason

They create a burden without reason.

Re: Living without a SIM card

#159

Post by chewz »

detaro wrote: post #155
chewz wrote: post #147

Earlier quoted context omitted.

In Poland most banks I use (Citibank, Santander, Millenium and others) require confirming logging into account via SMS at least once in two weeks. Some require confirmation via mobile app. (That wasn't obligatory before) Its rather that banks have phased out other methods like tokens as too expensive and troublesome. https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-... https://www.spidersweb.pl/2019/09/jak…

Even according to these articles, most support an app-based solution that doesn't require a phone number?

This isn't so. Yes you can use banking app but this might be even worse for privacy. It depends a lot on implementation details of the app. For example Santander app won't even start without permission to manage you phone on Android.

Re: Living without a SIM card

#160

Post by makruiten »

tracnar wrote: post #140
chewz wrote: post #129

I envy the OP. Unfortunately since September 2019 living without SIM card became (practically) illegal in EU. > most online payments above €30 to go through an extra level of verification such as entering a code received via a text message. [2] Most banks unwisely chosen SMS as Strong Customer Authentication providing little choice to customers. https://ec.europa.eu/info/law/payment-services-psd-2-directi... [2] http…

Most banks use their own card reader which you can use to authorize/sign a payment, I never had to use SMS for this.

And some banks (ING, bunq, but also others) don’t require anything else than just the mobile app, using either a pincode or biometric validation through your mobile OS. That’s way more practical, because you don’t need to have a reader in your pocket in order to do payments.
Post reply on HN