by glennos on 10/30/16, 9:40 AM with 187 comments
Feels like this is probably the result of telco networks wanting as much friction as possible to change providers, but is there something more to it?
by JoachimSchipper on 10/30/16, 10:18 AM
In most western countries, SIMs do little else; however, they are full application platforms, allowing stuff like Kenya's mobile payment network https://en.wikipedia.org/wiki/M-Pesa.
For what it's worth, you really don't want to have every network provider negotiate with Samsung for the particular access policy of that network. "Not compatible with your telephone" indeed!
by vidarh on 10/30/16, 10:49 AM
With SIM cards, users can switch to a new phone by just moving the SIM, or switch to a new provider while keeping their phone (assuming its unlocked) by just replacing the SIM.
Prior to SIM cards phones where frequently programmed to be tied to a specific provider.
A pure software solution could work, but requires the network operators to be able to trust the phone manufacturers to secure it well enough to not let end users change things in ways they're not supposed to (e.g. consider a hacker harvesting authentication details from phones). The SIM card is the simple solution.
by kalleboo on 10/30/16, 11:13 AM
But I'm glad for it, because the foresight of the designers of GSM to put your private key in a smartcard has absolutely improved consumer choice worldwide. I can buy an unlocked phone, travel to any country, buy a SIM card at the airport and pop it in my phone and the GSM(/UMTS/LTE) standards say it must work.
A software-based system will quickly devolve into a "oh we haven't approved this phone on our network, sorry we won't activate it" and other anti-consumer activities you saw on the ESN-registration-based US CDMA networks.
Hopefully when the GSMA adds eSIM to the standard, they add protections for consumer choice, but in the current corporate climate I fear they won't.
by jacquesm on 10/30/16, 10:40 AM
The SIM is what separates your identity from the hardware of the phone (which has its own identity called 'IMEI').
A 'software solution' would need a carrier, that carrier IS the SIM.
Another nice benefit of having the SIM device is that it makes it much harder to 'clone' a subscriber ID, something that would regularly happen in the days before the SIM card, note that the SIM was a development that came along with GSM, and that GSM was the first mobile phone standard resistant against cloning. It's one part of the 2FA (something that you have) that gives you access to the phone network (the other being the PIN code (something that you know) required to unlock the SIM).
by aq3cn on 10/30/16, 10:16 AM
I must add you can find flip phones cheaper than cost of lightening cables.
by bizzleDawg on 10/30/16, 10:46 AM
The GSMA and members (i.e. telcos) have been working on secure remote provisioning. I think it'll take a while for the technology to make it in to consumer devices, though it's likely to be used in IoT relatively soon.
It takes a long time to spec these things up collaboratively and then even longer for telco's to act on it!
See: http://www.gsma.com/rsp/2016/04/27/esim-opportunity-operator... and http://www.gsma.com/rsp/ (Warning: Lots of marketing BS)
by i336_ on 10/30/16, 2:31 PM
Quite a few years ago (2005?) a family member purchased a Samsung-branded dumbphone on a contract. (Monochrome LCD (something like 128x64?), polyphonic ringtones, 3 fixed games, a (really slow, GSM data) WAP browser; that was it. Model SGH-something, I vaguely recall.)
It had no SIM card slot. It was locked to the network (Orange - in Australia FWIW) via software. In order to unlock it we had to call up the telco and go through some process, which we decided not to do in the end (whatever it was, I don't recall), since the phone had less capabilities than the Nokias that flood India and similar places, so we concluded there was no point selling it by the time we dug it out one day and tried to figure out what to do with it. (It's still buried in a box somewhere IIRC.)
I think this is why SIM-less phones are reasonably rare - it's really, really hard to de-contract them, unlock them and put them into sellable (or whatever) condition. Then once you've done that the recipient has to go through some equally arcane process to get the thing linked to a plan/contract too. And considering the ability to pass a phone on is a fairly major selling point - phones aren't solely purchased [preconfigured] on plans, then disposed - I think this was explored somewhat by the industry but ultimately left alone.
Some of the other things I've found in this thread are really interesting, although I wonder how difficult it is to "unconfigure" such a device to sell or pass it on.
by mianos on 10/30/16, 10:27 AM
by ex3ndr on 10/30/16, 10:13 AM
by dismantlethesun on 10/30/16, 10:35 AM
In 3rd world countries, people regularly swithch their SIMs as they travel across borders because no one has cross-country access. Taking a SIM out only uses up a minute of your time, and standizing on a hardwardware dongle like that is great because if company A goes out of business, you just grab a new SIM and stick it in.
It's a bit harder in the US, where phones are locked to their providers, and you need IDs to buy SIMs but that's really all just a regulation issue, not a technical one.
by mrb on 10/30/16, 8:30 PM
Broken phone? Pop the SIM card into another phone, and you can immediately make and receive calls & texts on the new phone using your phone number.
If you had no SIM card, how would you authenticate yourself to the cell network (that's what the SIM card does)? Going online and then providing a username/password? This would be horrible security-wise as we all know people are terrible at picking secure unique passwords. So hackers could try to guess your password, then they would use your account, receives your calls & texts, and they could steal your cell data, causing you to receive large cellphone bills, etc. A total nightmare.
by raverbashing on 10/30/16, 11:11 AM
No, it is the opposite.
It is exactly done like this so you only need to get the sim card and not need to have the operator decide for you (of course people shoot themselves in the foot by signing a long term contract while getting a locked mobile phone)
by TorKlingberg on 10/30/16, 11:22 AM
As for why you still need them, I see some reasons:
1. The alternative may be worse. At least with SIM cards you can switch operator when you want (if the phone is not carrier locked, bleh), or use a local prepaid SIM when abroad.
2. Inertia. Removing the physical SIM would require getting operators and phone manufacturers to coordinate.
3. The IM card is what securely identifies the owner of a phone number, and makes sure they are not two phones with the same number. With a software SIM, if it is done wrong, you risk getting malware that steals your phone number.
Personally, I think we will eventually see SIM-free data only connections without a phone number. You really should be able to buy an LTE tablet, get online and just pay for some data. Apples has been trying a bit with the Apple SIM, but it is US only, and only works with a few operators.
by matheweis on 10/30/16, 4:14 PM
I hear you that it should be doable in software, although I'd argue that if anything you should still need the SIM as a sort of second factor. (Otherwise you run the risk of people stealing your phone account remotely).
by jlgaddis on 10/30/16, 11:08 AM
Honestly, I wish their use would expand into other areas of our lives -- replacing username and password combinations for various devices (working for an ISP, home routers are one good example).
As much as I'm against the idea of a mandatory "national ID", I'm convinced that it will happen someday (in .us, where I live). When it does, I believe it'll be something similar to US DoD's CAC [1]: a physical identification card that doubles as a smart card. The private keys stored on the card will allow you to prove your identity to your banks/financial institutions, e-mail account (100% encryption of all e-mails? Yes, please!), and so on.
by pmontra on 10/30/16, 10:52 AM
by atamyrat on 10/30/16, 10:23 AM
by smileysteve on 10/30/16, 3:57 PM
In the U.S., LTE is the first time that CDMA phones have had sim cards, that's ~2 years ago.
The software solution (using IMEI and PUK) is the old technology. It's less secure; verizon and sprint will charge you ~$40 activation fees, etc.
by informatimago on 10/30/16, 2:48 PM
A 100% purely software solution can be built based on white box encryption. It's slower and may be more easily attacked than a hardware protection (you never know if/when some genius mathematician or physician (quantum cryptographic attacks) breaks your encryption. But it has the advantage that it can run on all devices. cf. eg. https://www.trustonic.com/solutions/trustonic-hybrid-protect...
Then of course, there's the problem of key management and distribution thru software. Using a physical token has several good security properties. Replicating them in software (encryption) is difficult and error-prone. For end users, and service provides, it's much easier to swap a SIM card, than to install securely cryptographic keys and authentication tokens into his trusted execution environment even with the help of well written software.
by bogomipz on 10/30/16, 2:30 PM
1) One SIMs are a bit harder to tamper with than the OS of a phone which I am assuming would be the alternative to a SIM card i.e storing the same information on NAND flash accessible to the OS. SIMs have some threshold(it used to be 3) of unsuccessful attempts to read the card. A lock is activated and can only be unlocked entering the unlock code.
2) Carriers can talk directly to the SIM - A "SIM" is basically a Java applet that runs on UICC(Universal Integrated Circuit Card - the smart card itself.) I think a lot of people don't know that SIMs run Java - well Java Card. This mean that they can remotely lock a SIM card to prevent it from further accessing their network. If someone stole my phone or even just my SIM card I could call my carrier and they could lock the SIM remotely and consequently unlock it. They can also use the SIM to push new PRLs - preferred roaming lists. This is generally called OTA or over the air provisioning.
3)Convenience, if I use a pre-paid services with an MVNO or travel to another country and buy a pre-paid SIM while on holiday, I don't need to do anything else except insert the new SIM and power on the phone. What would the non-SIM card alternative look like? Its hard to imagine it being easier.
4)Carrier-locked phones, such as what you get when you are under contract to a carrier. The way phones are locked is by having the phone only accept SIMs from the carriers network. An unlocked phone will accept a SIM from any carriers network.
If anyone is interested this DEFCON presentation - "The Secret Life of SIM Cards", is pretty interesting:
https://www.defcon.org/images/defcon-21/dc-21-presentations/...
by tscs37 on 10/30/16, 7:34 PM
If I recall correctly german ISPs are trying to find a solution there by embedding the SIM into the device and then branding it on changing provider.
The problems SIM cards are (trying) solve is largely to "secure" the phone network. This mostly boils down who to send the large bill when shit goes fan. (The mobile network is pretty much non-secure, which is why SMS-2FA is not a good solution at all)
(They're also technically a backdoor for your ISP to do whatever they want)
Anyway, the reason SIM cards haven't died yet is probably because there is not much reason to replace them. They're tiny (so Apple doesn't kill it for half a millimeter of thickness) and pretty useful for the ISP to setup certificates and connection details.
by frik on 10/30/16, 10:13 AM
by jaboutboul on 10/30/16, 11:23 AM
It lets you virtually subscribe to a network, so for example if you're traveling, you don't need a local card just pop up some software and choose a new network.
Apple already has some devices that implement it, AFAIK, the iPad Pros use this. Apple calls it Apple SIM (https://techcrunch.com/2016/03/23/explainer-alert-heres-what...)
by Razengan on 10/30/16, 7:47 PM
Apple have begun a limited initiative towards just that: http://www.apple.com/ipad/apple-sim/
Telephone and internet connectivity should really be like electric supply and other utilities. We should be able to connect wherever we are and pay as-we-go through our device.
As an interesting aside, here's look at just how complex SIMs are: https://news.ycombinator.com/item?id=12674846
They are practically equal to the computers we were using 30 years ago!
by roaming_taco on 10/30/16, 5:09 PM
Why would I want a SIM card with one IMSI on it when I can have a SIM card with up to 20 IMSIs from various networks all around the world, or even better the ability to constantly swap and trade IMSIs from various networks, new connectivity set everyday. A global community calls for global connectivity.
by trprog on 10/30/16, 2:54 PM
I don't understand how you came to this conclusion.
I move between networks very regularly due to frequent travel to different countries. Pulling out your old sim card and putting in a new sim takes maybe 2 minutes. You are then immediately off your old network and on the new network. Once you have the sim in your possession you don't need to talk to anyone, fill in any details, log into anything or even remember anything.
Short of some process that is 100% automatic I can't imagine a more low friction process.
by mschuster91 on 10/30/16, 10:17 AM
1) Security: telco laws these days often require registration of accounts to your personal ID (i.e. no anonymous usage any more). How would a pure soft-SIM be able to fetch the data from the network?
2) Flexibility: SIM is pretty much standardized. This means a newcomer MVNO just has to issue SIM cards and the customer can use any kind of phone (or other interface, like a modem, a 2G/3G shield, ...) to use the network. And if a device breaks, then the SIM card usually stays intact and can be placed in a new device. Not sure how to securely do this with a soft-SIM.
by JoshTriplett on 10/30/16, 7:58 PM
by rxbudian on 11/2/16, 7:35 PM
by alien3d on 10/30/16, 11:39 AM
by droopybuns on 10/31/16, 12:24 AM
It also is a classic telco hedge.
Step 1) We need towers to make this thing work. Let's build towers.
Step 2) These towers are super expensive and make the expense amortization complicated. Let's sell the towers and then lease from the buyer.
Step 3) oh crap. There is no encryption and people are cloning handsets. Let's use SIM cards to separate sensitive operations from the rest of the device.
Step 4) manufacturing sims is complicated. Let's buy sims from other suppliers and make them sign off on unlimited liability clauses if their identity solution is compromised.
It is all about two things: Preventing a single player from having too much power on the ecosystem and transferring financial risk. There is no evil plan. It's all rather mundane.
by maxerickson on 10/30/16, 10:32 AM
Same with switching devices and keeping a provider. Using a SIM, takes about a minute. Not using a SIM? Call them or whatever, maybe pay a fee.
by akytt on 10/30/16, 11:11 AM
by sdevoid on 10/30/16, 10:37 PM
It amuses me that these slim-SIMs, and SIM cards in general, are one of the few pieces of technology that are utterly opaque to the user and yet are so widespread.
Edit: For example, I recently upgraded to an iPhone 7, at the Apple store. This required a new SIM card, but the salesperson was very careful to return the old SIM card to me. Why? What am I supposed to do with this old SIM card?
by KON_Air on 10/30/16, 10:29 AM
by xaduha on 10/30/16, 12:35 PM
Here I am, asking myself why smartcards aren't so hot in modern 'hacker' community...
by Dwolb on 10/30/16, 10:26 AM
Also see a company called SIMless.
There's a lot of market momentum around SIM cards and it keeps a telco's offering really sticky. It is more effort for people to swap hardware instead of software.
by foobarqux on 10/30/16, 8:22 PM
by grymoire1 on 10/30/16, 11:11 AM
Each SIM has a unique ID that is used to track/bill/identify your phone.
by threeseed on 10/30/16, 10:25 AM
It contains what is known as a remote provisioning SIM: https://www.gsmaintelligence.com/research/?file=81d866ecda8b...
So clearly the only thing stopping the industry is the telcos who would very much like to make it as difficult as humanely possible for you to switch carriers. Especially in the US where there is a lot of competition and hence high churn.
by ndesaulniers on 10/30/16, 7:26 PM
by nik736 on 10/30/16, 11:21 AM
by RandyRanderson on 10/30/16, 1:29 PM
I, and many others were surprised at that deal because, up to that point, ppl had essentially carrier-owned phones and long contracts that locked subs (subscribers) to their network. This deal would allow ppl to install any software from the app store without telco approval.
Telcos see the SIM card as their last beachhead. They are looking for at least 2 revue streams from this NFC SE (Secure Element)[1] real estate:
1 Identity verification - Telcos rent "space" on the SE on which you store health cards, passports, driver's licenses, etc. 2 Cards - Telcos rent "space" on which you store credit, gift, debit cards.
Carriers and Issuers (the bank that issues your credit card) are now fighting over that potential revenue stream (spoiler: it's tiny) while Apple has gone and deployed it with Apple Watch et al and is making a cut of the transaction fee. In contrast, the transaction fee is a huge stream however one can imagine the fun of negotiating a contract between all the parties involved (likely all multibillion dollar companies with teams of lawyers).
Apple had tried to push a software SIM (containing a SE) but the carriers, from their POV, rightly and vigorously fought and will continue to fight against that[2]. Google is also trying with Android Wallet/Pay/...
I suspect Apple will eventually use the same "wedge" approach with one of the US carriers and the others will fall in line.
[0] https://www.engadget.com/2010/05/10/confirmed-apple-and-atan... [1] https://en.wikipedia.org/wiki/Near_field_communication#Appli... [2] http://www.thememo.com/2015/07/30/five-years-on-apples-battl...
by noja on 10/30/16, 10:16 PM
by markgamache1 on 10/30/16, 7:55 PM
by gok on 10/30/16, 10:17 PM