15 ms·

The SIM card is a smart card, i.e. a secure piece of hardware, that protects the telephone network from the subscriber - most importantly, it ensures that the n

The SIM card is a smart card, i.e. a secure piece of hardware, that protects the telephone network from the subscriber - most importantly, it ensures that the network has someone to bill. In most western countries, SIMs do little else; however, they are full application platforms, allowing stuff like Kenya's mobile payment network https://en.wikipedia.org/wiki/M-Pesa https://en.wikipedia.org/wiki/M-Pesa. For what it's worth, you really don't want to have every network provider negotiate with Samsung for the particular access policy of that network. "Not compatible with your telephone" indeed!

uola 10y ago
Yeah, while I can appreciate the question (curiosity is a good things) I don't think anyone with experience of software should be surprised. When you consider things like passwords, credit cards, wifi login and e-mail addresses the question is really why aren't more things like sim cards. (which is kind of what Apple is trying to do these days?)
- bonzini 10y ago
  The Yubikey Neo and similar gadgets are pretty much the same thing as USB smart cards. The software could be improved but in the end it is a pretty convenient way to achieve two factor authentication.
mherrmann 10y ago
Doesn't every login form on the web also protect the respective operator from the subscriber? Why can't a "software SIM" simply be a username and a password? My explanation is that it's difficult to change something that literally the entire world uses.
- kalleboo 10y ago
  We're moving away from usernames and passwords though, into 2-factor systems such as... smart cards (Chip and PIN). Regressing phones back into usernames and passwords is a clear step backwards in security.
  - esquivalience 10y ago
    Yes, and remember too that SIMs are standardised technology from the mid-1990s, originating in GSM. It's not a trivial matter to change security in globally standardised technology. (and Even if you did, it would need to be backward-compatible and still support SIM cards) There is a good deal more to telecoms tech than just the tech side - the standardisation process brings a whole bunch of competitor companies into a room to develop a solution, incrementally over a number of years. This applies from physical aspects all the way up to higher level concerns like security. It's a fascinating development process.
- jacquesm 10y ago
  Who would you want to hold your 'software SIM' username and password? What's to stop someone else from logging in to your account once they have your credentials?
  - mherrmann 10y ago
    I have hundreds of usernames and passwords for various web sites and don't see a problem in having one more(?)
    - jacquesm 10y ago
      Interesting. I try to keep the number of usernames and passwords I have to an absolute minimum because I don't trust any of those to keep that secret, nor do I trust my computer to not spill the secrets somehow through a browser bug or other drive by exploit. At the same time I totally trust my sim, it's never been more than 10 meters away from me in the last decade or two, hasn't failed me even once and it would be very hard to get it to cough up its secrets without my cooperation (so rubber hose cryptography would still work). Contrary to www security the phone system seems - from my perspective - at least to have done a half decent job at integrating 2FA when your average website - 20 years later - is still making up its mind about whether or not that might be a useful thing to add.
    - Strom 10y ago
      If you use actual strong passwords then you are an outlier. Most people use basic words like "password" as shown by every password dump in history. Indeed, most people would use the very same weak password they use for their e-mail for their mobile, and this would reduce protection against spoofing versus continuing to use the SIM system. What we need is a SIM-type system on the web as well, not to bring the broken web password system elsewhere.
      - another 10y ago
        Furthermore, any security system that effectively relies on the user possessing more than one computing device (e.g., using your laptop for access to a password manager or email address) fails for the significant and increasing swath of humanity for which their phone is their [first and] only such device.
- user5994461 10y ago
  Because username and password is a disaster for security. It's sole purpose is let ANY guy ANY where on the planet connect to your account. SIM cards are cryptographic hardware tokens. They are much more secure than passwords. In fact, they do need a password as well on top of the hardware token, that's the 'PIN code' you have to enter when you (re)boot your phone.
  - mherrmann 10y ago
    Most of the internet runs on usernames/passwords. I understand that a hardware token (with a PIN) is more secure. But is it worth the added complexity?
    - jacquesm 10y ago
      > But is it worth the added complexity? If you don't want your account to be hacked: yes.
    - pjc50 10y ago
      The SIM protects the carrier against "account sharing". It allows them to be sure that a subscriber is only using one phone at once - although it's portable between phones. It means that carriers don't have to maintain "sessions" centrally. The SIM can authenticate you to the base station without the base station having to check back to see if you're logged in elsewhere - vital in reducing the latency of cell changes. (It also stores various bits of technical information for SMS/MMS routing, and was intended to be a platform for "value added" applications.
      - jacquesm 10y ago
        Account sharing in a telco context is a bad thing all around. Which phone would you like to ring? How do you ensure the charges really are made by (and to) the right person? How will you protect against messages with important information landing with the wrong party? Authentication in a telco context is a good thing, the fact that the web doesn't have it enabled a large number of applications to flourish, it also made some other things devilishly hard, or even almost impossible.
- deleted 10y ago
  [deleted]
Strom 10y ago
In Estonia, you can use your SIM to create a government recognizeed digital signature. [1] Thus, you not only identify yourself to the mobile operator, but you can also identify yourself to banks, government services, and more. [1] https://e-estonia.com/component/mobile-id/ https://e-estonia.com/component/mobile-id/
- anlif 10y ago
  The same idea is used in Norway. Most banks and public services (e.g. tax returns) use this system for online two-factor authentication. [1] https://www.bankid.no/en/ https://www.bankid.no/en/
  - shshhdhs 10y ago
    Didn't NIST just say two factor via mobile is a "bad idea"? Have Norway or Estonia responded? EDIT: Thank you whoever downvoted an honest question that added to the discussion
    - captn3m0 10y ago
      I think that was for SMS, not specifically mobile.
    - brainfire 10y ago
      The bad idea is being sent a (potentially interceptable) SMS with a code. The Estonian method is described as using a private key present on the SIM card, just like a normal smart card used for authenticating/signing.
      - candiodari 10y ago
        That's how every bank I know in Australia, at least 2 US banks and 4 European banks do it. Transfer (sometimes login too) ? Code over SMS. Besides, pretty much all banks simply use 2 or 3 factor authentication as an anticompetitive tactic (half the businesses in most countries pay the banks 2-300$ per month just for scheduled download of transactions)
glennos 10y ago
I hadn't thought about the security of being a physical token. Feels like you could do 2FA using someone's email (or similar) to protect against some scenarios, but take the point that someone having to steal something physical changes the attack surface.
userbinator 10y ago
The SIM card is a smart card If you have a credit/debit card with a chip, look at the arrangement of the contacts and compare to a SIM card. It's essentially the same standard (ISO 7816) at the lower layers, but with different application-layer protocols on top. Also, as a matter of being the only device in posession of the subscriber but arguably owned by the telco, I'd definitely prefer it to be a removable piece which communicates over a standard interface. The alternative of embedding it into the handset is far worse from the perspective of lock-in and perhaps security.
- gcb0 10y ago
  /me puts on tinfoil hat the sim card has one important difference. It lives in a device that provides it with 24/7 battery and radio access. That is really worrisome when you think about. A tiny computer running applications you have no idea/access. powered 24/7. Always with you. With access to battery, network, mic, etc. And the other side of the network that could monitor it's traffic for malicious actions is owned by the very people that could abuse it in the first place.
  - derefr 10y ago
    > powered 24/7 Is it? When you turn on "airplane mode" on a phone, is there a reason for the SIM to still be receiving power at that point?
    - zamalek 10y ago
      > Is it? Easy to test: add a SIM pin, turn on airplane mode and reboot your phone.
    - gcb0 10y ago
      yes. the sim has direct access to the radio and other modules, by design. it only needs the actual phone cpu/os for use interface. if it wants to take the radio out of silent mode it can.
      - 10y ago
RandyRanderson 10y ago
Even small carriers have software customizations done to phone firmware deployed on their network. This is common. I believe he's contrasting this between a built-in solution. So say Samsung would put a hardwired UICC (SIM) in the phone and ATT say would make Samsung give ATT an "area" (Security Domain" in UICC parlance) to provision. For all intents and purposes it would work the same. If you wantd to switch carriers I'm guessing there would be a 'virtual' switch SIM app or some such. If you're bored, you can read about it here: https://www.globalplatform.org https://www.globalplatform.org
RyJones 10y ago
Here is a great video[0] with an exploration of using SIMs for a (very) micro telco, including a discussion of the APIs available [0] https://www.youtube.com/watch?v=_-nxemBCcmU https://www.youtube.com/watch?v=_-nxemBCcmU
agumonkey 10y ago
I recently read the Wikipedia pages for health cards, and was surprised that these are demi-computers (by that I mean, no IO, no power). Standard chips are 4MHz >8bits these days (with added crypto etc). A Gameboy Air.
arsmoriendi 10y ago
I'd love to study a piece of software like M-Pesa.

uola 10y ago

Yeah, while I can appreciate the question (curiosity is a good things) I don't think anyone with experience of software should be surprised. When you consider things like passwords, credit cards, wifi login and e-mail addresses the question is really why aren't more things like sim cards. (which is kind of what Apple is trying to do these days?)

bonzini 10y ago
The Yubikey Neo and similar gadgets are pretty much the same thing as USB smart cards. The software could be improved but in the end it is a pretty convenient way to achieve two factor authentication.

mherrmann 10y ago

Doesn't every login form on the web also protect the respective operator from the subscriber? Why can't a "software SIM" simply be a username and a password? My explanation is that it's difficult to change something that literally the entire world uses.

kalleboo 10y ago
We're moving away from usernames and passwords though, into 2-factor systems such as... smart cards (Chip and PIN). Regressing phones back into usernames and passwords is a clear step backwards in security.
- esquivalience 10y ago
  Yes, and remember too that SIMs are standardised technology from the mid-1990s, originating in GSM. It's not a trivial matter to change security in globally standardised technology. (and Even if you did, it would need to be backward-compatible and still support SIM cards) There is a good deal more to telecoms tech than just the tech side - the standardisation process brings a whole bunch of competitor companies into a room to develop a solution, incrementally over a number of years. This applies from physical aspects all the way up to higher level concerns like security. It's a fascinating development process.
jacquesm 10y ago
Who would you want to hold your 'software SIM' username and password? What's to stop someone else from logging in to your account once they have your credentials?
- mherrmann 10y ago
  I have hundreds of usernames and passwords for various web sites and don't see a problem in having one more(?)
  - jacquesm 10y ago
    Interesting. I try to keep the number of usernames and passwords I have to an absolute minimum because I don't trust any of those to keep that secret, nor do I trust my computer to not spill the secrets somehow through a browser bug or other drive by exploit. At the same time I totally trust my sim, it's never been more than 10 meters away from me in the last decade or two, hasn't failed me even once and it would be very hard to get it to cough up its secrets without my cooperation (so rubber hose cryptography would still work). Contrary to www security the phone system seems - from my perspective - at least to have done a half decent job at integrating 2FA when your average website - 20 years later - is still making up its mind about whether or not that might be a useful thing to add.
  - Strom 10y ago
    If you use actual strong passwords then you are an outlier. Most people use basic words like "password" as shown by every password dump in history. Indeed, most people would use the very same weak password they use for their e-mail for their mobile, and this would reduce protection against spoofing versus continuing to use the SIM system. What we need is a SIM-type system on the web as well, not to bring the broken web password system elsewhere.
    - another 10y ago
      Furthermore, any security system that effectively relies on the user possessing more than one computing device (e.g., using your laptop for access to a password manager or email address) fails for the significant and increasing swath of humanity for which their phone is their [first and] only such device.
user5994461 10y ago
Because username and password is a disaster for security. It's sole purpose is let ANY guy ANY where on the planet connect to your account. SIM cards are cryptographic hardware tokens. They are much more secure than passwords. In fact, they do need a password as well on top of the hardware token, that's the 'PIN code' you have to enter when you (re)boot your phone.
- mherrmann 10y ago
  Most of the internet runs on usernames/passwords. I understand that a hardware token (with a PIN) is more secure. But is it worth the added complexity?
  - jacquesm 10y ago
    > But is it worth the added complexity? If you don't want your account to be hacked: yes.
  - pjc50 10y ago
    The SIM protects the carrier against "account sharing". It allows them to be sure that a subscriber is only using one phone at once - although it's portable between phones. It means that carriers don't have to maintain "sessions" centrally. The SIM can authenticate you to the base station without the base station having to check back to see if you're logged in elsewhere - vital in reducing the latency of cell changes. (It also stores various bits of technical information for SMS/MMS routing, and was intended to be a platform for "value added" applications.
    - jacquesm 10y ago
      Account sharing in a telco context is a bad thing all around. Which phone would you like to ring? How do you ensure the charges really are made by (and to) the right person? How will you protect against messages with important information landing with the wrong party? Authentication in a telco context is a good thing, the fact that the web doesn't have it enabled a large number of applications to flourish, it also made some other things devilishly hard, or even almost impossible.
deleted 10y ago
[deleted]

Strom 10y ago

In Estonia, you can use your SIM to create a government recognizeed digital signature. [1] Thus, you not only identify yourself to the mobile operator, but you can also identify yourself to banks, government services, and more. [1] https://e-estonia.com/component/mobile-id/ https://e-estonia.com/component/mobile-id/

anlif 10y ago
The same idea is used in Norway. Most banks and public services (e.g. tax returns) use this system for online two-factor authentication. [1] https://www.bankid.no/en/ https://www.bankid.no/en/
- shshhdhs 10y ago
  Didn't NIST just say two factor via mobile is a "bad idea"? Have Norway or Estonia responded? EDIT: Thank you whoever downvoted an honest question that added to the discussion
  - captn3m0 10y ago
    I think that was for SMS, not specifically mobile.
  - brainfire 10y ago
    The bad idea is being sent a (potentially interceptable) SMS with a code. The Estonian method is described as using a private key present on the SIM card, just like a normal smart card used for authenticating/signing.
    - candiodari 10y ago
      That's how every bank I know in Australia, at least 2 US banks and 4 European banks do it. Transfer (sometimes login too) ? Code over SMS. Besides, pretty much all banks simply use 2 or 3 factor authentication as an anticompetitive tactic (half the businesses in most countries pay the banks 2-300$ per month just for scheduled download of transactions)

glennos 10y ago

I hadn't thought about the security of being a physical token. Feels like you could do 2FA using someone's email (or similar) to protect against some scenarios, but take the point that someone having to steal something physical changes the attack surface.

userbinator 10y ago

The SIM card is a smart card If you have a credit/debit card with a chip, look at the arrangement of the contacts and compare to a SIM card. It's essentially the same standard (ISO 7816) at the lower layers, but with different application-layer protocols on top. Also, as a matter of being the only device in posession of the subscriber but arguably owned by the telco, I'd definitely prefer it to be a removable piece which communicates over a standard interface. The alternative of embedding it into the handset is far worse from the perspective of lock-in and perhaps security.

gcb0 10y ago
/me puts on tinfoil hat the sim card has one important difference. It lives in a device that provides it with 24/7 battery and radio access. That is really worrisome when you think about. A tiny computer running applications you have no idea/access. powered 24/7. Always with you. With access to battery, network, mic, etc. And the other side of the network that could monitor it's traffic for malicious actions is owned by the very people that could abuse it in the first place.
- derefr 10y ago
  > powered 24/7 Is it? When you turn on "airplane mode" on a phone, is there a reason for the SIM to still be receiving power at that point?
  - zamalek 10y ago
    > Is it? Easy to test: add a SIM pin, turn on airplane mode and reboot your phone.
  - gcb0 10y ago
    yes. the sim has direct access to the radio and other modules, by design. it only needs the actual phone cpu/os for use interface. if it wants to take the radio out of silent mode it can.
    - 10y ago

RandyRanderson 10y ago

Even small carriers have software customizations done to phone firmware deployed on their network. This is common. I believe he's contrasting this between a built-in solution. So say Samsung would put a hardwired UICC (SIM) in the phone and ATT say would make Samsung give ATT an "area" (Security Domain" in UICC parlance) to provision. For all intents and purposes it would work the same. If you wantd to switch carriers I'm guessing there would be a 'virtual' switch SIM app or some such. If you're bored, you can read about it here: https://www.globalplatform.org https://www.globalplatform.org

RyJones 10y ago

Here is a great video[0] with an exploration of using SIMs for a (very) micro telco, including a discussion of the APIs available [0] https://www.youtube.com/watch?v=_-nxemBCcmU https://www.youtube.com/watch?v=_-nxemBCcmU

agumonkey 10y ago

I recently read the Wikipedia pages for health cards, and was surprised that these are demi-computers (by that I mean, no IO, no power). Standard chips are 4MHz >8bits these days (with added crypto etc). A Gameboy Air.

arsmoriendi 10y ago

I'd love to study a piece of software like M-Pesa.