3 ms·

SIM PIN codes seem to have gone out of fashion. Neither my UK SIM nor my US SIM, both bought within the last two years, had a PIN code out of the box. Of course

SIM PIN codes seem to have gone out of fashion. Neither my UK SIM nor my US SIM, both bought within the last two years, had a PIN code out of the box. Of course it's possible to set one but that's buried somewhere deep in the phone's settings, so most people probably don't set one.

metafunctor 10y ago
I didn't even know it's possible to have no PIN code on a SIM card! Operators in Finland always give you PIN cards with a preset code like 0000 or 1234, and tell you to switch it in their quick start instructions. I'm sure many people leave it as it is, though. Almost no-one seems to know you can actually set it to be more than 4 digits. This looks like an area that phone operating systems could fix – by making it easy to change your PIN, and encourage using more than 4 digits for it.
- pbhjpbhj 10y ago
  Is there anything to stop one from brute-forcing the PIN? It's just numbers, what's the upper limit for length. Ah, http://www.techrepublic.com/article/pro-tip-protect-your-android-sim-card-with-sim-pin-lock/ http://www.techrepublic.com/article/pro-tip-protect-your-and... suggests that you have 3 attempts, then there's a separate system (PIN Unlock Key, PUK) which a comment notes gives 10 attempts. I'm wondering if you can read the data straight off the card via some physical means, attack that to get the PIN?
  - metafunctor 10y ago
    I'm guessing in most cases it's much easier to socially engineer the service provider customer support, rather than attack the SIM hardware.
    - pbhjpbhj 10y ago
      You're probably right depending on the scale you're trying to crack the cards at - went digging and found http://www.theregister.co.uk/2015/08/06/researchers_crack_sim_card_aes128_encryption_in_10_minutes_for_cloning/ http://www.theregister.co.uk/2015/08/06/researchers_crack_si... which was pertinent and interesting to me.

metafunctor 10y ago

I didn't even know it's possible to have no PIN code on a SIM card! Operators in Finland always give you PIN cards with a preset code like 0000 or 1234, and tell you to switch it in their quick start instructions. I'm sure many people leave it as it is, though. Almost no-one seems to know you can actually set it to be more than 4 digits. This looks like an area that phone operating systems could fix – by making it easy to change your PIN, and encourage using more than 4 digits for it.

pbhjpbhj 10y ago
Is there anything to stop one from brute-forcing the PIN? It's just numbers, what's the upper limit for length. Ah, http://www.techrepublic.com/article/pro-tip-protect-your-android-sim-card-with-sim-pin-lock/ http://www.techrepublic.com/article/pro-tip-protect-your-and... suggests that you have 3 attempts, then there's a separate system (PIN Unlock Key, PUK) which a comment notes gives 10 attempts. I'm wondering if you can read the data straight off the card via some physical means, attack that to get the PIN?
- metafunctor 10y ago
  I'm guessing in most cases it's much easier to socially engineer the service provider customer support, rather than attack the SIM hardware.
  - pbhjpbhj 10y ago
    You're probably right depending on the scale you're trying to crack the cards at - went digging and found http://www.theregister.co.uk/2015/08/06/researchers_crack_sim_card_aes128_encryption_in_10_minutes_for_cloning/ http://www.theregister.co.uk/2015/08/06/researchers_crack_si... which was pertinent and interesting to me.