Apple said to be preparing for iPhones without SIM card slot in 2022 • Hacker News Board

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#141

Post by gruturo » Tue, Dec 28, 2021, 2:15 PM UTC

Nextgrid wrote: post #93

csunbird wrote: post #84

Earlier quoted context omitted.

I am sorry, but what? You can just remove the association of the eSIM with the telephone and activate it in another. There is no lock in here.

Sorry, you can't. The e-SIM provisioning process is under the control of the carrier. They give you a QR code (or SM-DP string) which you scan/enter, your phone then contacts the carrier and after some back and forth acquires cryptographic keys which are stored in the eSIM chip. There is no way to extract these cryptographic keys and enter them into another phone. Instead, you have to repeat the whole process and get…

> There is no way to extract these cryptographic keys and enter them into another phone. Instead, you have to repeat the whole process and get a new QR code from the carrier. They may charge for this, or just be a pain in general and make it difficult or refuse for whatever reason.

Even worse, in many real cases. Let me give you an example, happened to me this October:

I get a new phone. I browse my carrier's website to find out how to transfer the eSim to the new one, but find nothing. I call them, they tell me it's impossible. I ask them to double check because this doesn't seem realistic - after one day of internal checks, they contact me saying they found a way! I just have to request to be migrated back to a physical SIM (costing me 15 EUR and 1 week of waiting), and when it will arrive I'll be able to migrate it to an eSIM again!

Isn't technology amazing?

This was in Germany, the operator is Congstar, an MVNO using Deutsche Telekom's network.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#142

Post by threeseed » Tue, Dec 28, 2021, 2:15 PM UTC

keraf wrote: post #57

Hopefully by removing the SIM tray, they have now enough space to put the headphone jack back. (bit of sarcasm but I really miss headphone jacks in mobile phones)

> but I really miss headphone jacks in mobile phones

Buy a USB-C/Lightning to 3.5mm dongle and leave it permanently attached. Not ideal I know.

But one benefit is that the DAC Apple designed in that dongle is so good that the sound quality far exceeds any phone with a built-in 3.5mm jack.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#143

Post by arthur_sav » Tue, Dec 28, 2021, 2:17 PM UTC

boondaburrah wrote: post #65

I can't understand why anyone would want this. Being able to physically swap sims so I don't ever have to deal with carrier customer service is a /good/ thing, especially when it's in the carrier's interest to make this as difficult as possible.

I feel like this is a "cars can't replace horses" kind of debate.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#144

Post by Nextgrid » Tue, Dec 28, 2021, 2:18 PM UTC

thirdlamp wrote: post #134

junon wrote: post #113

Earlier quoted context omitted.

Because SIMs require the physical card. You cannot forge a SIM without the SIM itself. There's a physical second factor. Usernames and passwords get leaked all the time, and since Reddit et al are meant to be accessed by multiple devices, device-locking them would be antithetical and anti-consumer. A phone service is implicitly device-locked (well, doesn't have to be, but it doesn't make sense to allow multiple devic…

> but it doesn't make sense to allow multiple devices per number anyway Why not? This is a useful behavior that is currently emulated by forwarding calls to laptops and tablets with the same account when the devices are on the same Wi-Fi. You could get rid of the Wi-Fi requirement if those devices all simply had an eSIM with the same number.

Number assignment is handled at the network level. I have the exact functionality you speak of (single number to multiple devices) on my company's good old physical SIMs.

Phones & SIMs don't even know nor care about their own number. The SIM has a field for that but in fact it's often left empty (iOS devices discover their own number by texting a known Apple number and getting the response via the Internet, they'll then populate this field out of courtesy but it's not necessary for functionality).

When a call comes in, the carrier decides which SIM it should be routed to. When a SIM makes an outbound call, the carrier decides which number to set as caller ID.

The functionality you speak of has nothing to do with SIM vs eSIM, it's about carriers having to actually innovate and do some engineering. Their current oligopoly means there's no commercial pressure for them to do so, and there's no reason why they would suddenly do this with the switch to eSIMs.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#145

Post by mschuster91 » Tue, Dec 28, 2021, 2:20 PM UTC

hulitu wrote: post #53

siva7 wrote: post #22

Finally all the carriers in the world will be forced to introduce eSim. Thanks Apple

Finaly OTA. What can go wrong when everybody can program your SIM remotely ?

> What can go wrong when everybody can program your SIM remotely?

That's bollocks. An eSIM module is exactly the same chip as in a normal SIM card - right down to the electric specifications and communication protocols, so you can hook up a provisioned eSIM module to a phone or a SIM card to a device using an eSIM chip and it will Just Work (tm).

The only difference is that the eSIM module is allowing the baseband chip to flash a new set of cryptographic keys, a process that will (usually) require the cooperation of the main SoC to get and transmit said keys.

The only scenarios where an attacker could reprogram your SIM remotely is either a malicious actor in the provider network (at which point there is the question why an attacker would want to reprogram your SIM at that point, given all they can do is give your SIM card access keys to another network) or a malicious actor with an IMSI catcher.

In both scenarios the attacker would require an exploit in your specific baseband and the correct cryptographic keys (or yet another exploit) for the eSIM to accept the new profile... and at the degree of knowledge, hardware and the actual exploits required to get to the point a successful attack requires, your attacker will be a government or an NSO-scale enterprise. And seriously, at that point you already have lost anyway because they have exploits for the OS you're running on whatever device you use, they don't need to deal with taking over your SIM card.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#146

Post by Nextgrid » Tue, Dec 28, 2021, 2:21 PM UTC

PragmaticPulp wrote: post #129

jwr wrote: post #66

I am very worried about this. While I love (and sometimes use) eSIMs, the physical SIM has a huge advantage in that it gives me freedom. It's the revolution that GSM brought: just take your SIM and move it to a different phone. No permission required. Arguably we've become slaves to ecosystems of either Apple or Google at this point, as pretty much nobody uses a phone as "just a phone", you need to have an account wi…

> Arguably we've become slaves to ecosystems of either Apple or Google at this point I’m far more worried about the SIM cards than Apple or Google. Did you know that SIM cards run Java? Or that they can send text messages from your phone directly to the baseband without going through the phone itself? Your SIM is probably sending data to your carrier without you knowing. ( https://scribe.rip/telecom-expert/what-is-at…

> move everything to purely digital number porting

There's a common misconception that SIM == number. That's not the case. The SIM is simply the identity of your device to a carrier.

> a little card that runs Java

I believe (it's now been a few years since I've skimmed the spec) that the eSIM chip can also run Java and download applets.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#147

Post by tjpnz » Tue, Dec 28, 2021, 2:22 PM UTC

arthur_sav wrote: post #140

jwr wrote: post #66

I am very worried about this. While I love (and sometimes use) eSIMs, the physical SIM has a huge advantage in that it gives me freedom. It's the revolution that GSM brought: just take your SIM and move it to a different phone. No permission required. Arguably we've become slaves to ecosystems of either Apple or Google at this point, as pretty much nobody uses a phone as "just a phone", you need to have an account wi…

Realistically when was the last time you switched your SIM card? I only change it when i change phones.

Last time I was in SE Asia it wasn't uncommon to see people carrying multiple SIM cards. They were sold cheap and providers were constantly undercutting each other on mobile data. This was almost a decade ago now, but given how Asian variants of phones still have dual SIM slots I'm guessing it's still common.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#148

Post by LeonidasXIV » Tue, Dec 28, 2021, 2:23 PM UTC

jwr wrote: post #66

I am very worried about this. While I love (and sometimes use) eSIMs, the physical SIM has a huge advantage in that it gives me freedom. It's the revolution that GSM brought: just take your SIM and move it to a different phone. No permission required. Arguably we've become slaves to ecosystems of either Apple or Google at this point, as pretty much nobody uses a phone as "just a phone", you need to have an account wi…

> It's the revolution that GSM brought: just take your SIM and move it to a different phone. No permission required.

This is not really true:

1. SIM-lock is a thing, where providers prevent you from using the phone with another SIM (because they sold you the phone below cost and you're paying it back through your subscription cost)

2. IMEI lock is a thing too, unfortunately. The situation might be different now but in 2011/2012 it was near impossible to use a local SIM in your phone in Japan because phone providers wanted to sell you a phone with a SIM so you can't use your desired phone.

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#149

Post by [deleted] » Tue, Dec 28, 2021, 2:24 PM UTC

Nextgrid wrote: post #126

jtbayly wrote: post #124

Earlier quoted context omitted.

I think you are confused. SIM cards are not a second factor. SIM swaps are proof of this.

SIM is the second factor when it comes to proving that this device with this physical SIM is indeed accessing the network. Fraudulent SIM swaps are attacking a different layer of the system, they are social-engineering underpaid idiots to associate a new SIM with a given account & number. You could in theory social-engineer a bank to reissue someone's payment card and somehow intercept it in the post or steal it from…

[deleted]

Re: Apple said to be preparing for iPhones without SIM card slot in 2022

#150

Post by mrtksn » Tue, Dec 28, 2021, 2:24 PM UTC

Nextgrid wrote: post #136

mrtksn wrote: post #131

Earlier quoted context omitted.

SIM cards are famously the weak link in the 2FA. They have all kind of security issues as they are computers themselves. The way forward is to get rid of the SIM and access those carrier networks through credentials, ideally I would love to see it as a cryptographic receipt that you get from your payment provider and pass it to the the carrier as a proof of right for account and usage of their networks.

SMS-based 2FA's weakness is not due to SIM cards. It's due to carriers being shit. SMS-based 2FA is not exploited by breaking any cryptography or exploiting some software vulnerability. It's by "asking nicely" the carrier's customer support idiots to associate a new SIM to the target account & number. Replacing the SIM with username/password wouldn't do anything - instead of the attackers having to associate a new ph…

Those SIM engineers should build other unhackable systems too!

Anyway, it's not only social engineering but even if it was it simply means that it's useless for security.

Just yesterday, a friend of mine got a fringe hacking incident or a bug. We are not still sure if it was hack but somehow the SIM card in her phone identified as another number from another carrier. Who knows what happened, her SIM wasn't swapped it simply think that it's another number as she found out when started receiving notifications about her new number. Maybe it was Apple's bug or something but who cares, the physical SIM did not change anything.