4 ms·

The SIM card one is actually used by SIM card developers, I've had a few of those on my desk in a previous life. Basically, when developing applets for SIM car

by jfim 7y ago

The SIM card one is actually used by SIM card developers, I've had a few of those on my desk in a previous life. Basically, when developing applets for SIM cards, it's a lot easier to deal with plugging in a full sized SIM card in a large slot than dealing with a tiny modern size SIM card, especially when dealing with multiple handsets. The testing process with a handset is simply to write the applet on the card using a full sized smart card reader, then take the card, put it in the handset and boot it. With the adapter, the steps of putting the card in the handset and taking it out are much easier, since there's no need to move a tiny card and extract it using a tool.

Zenst 7y ago
Yes, the aspect that you need to test things on many mobile networks does become easier when you can easily switch the SIM - that alone makes it kinda essential - unless you have multiple devices for each network and there are a lot - more so if you factor in roaming. That and nobody ever advertises how many times you can swap a sim and the socket pins won't break. Kinda makes you wonder how many times you can swap a sim before the socket suffers failure of some form, from wear and tear. I've certainly had a fair few break over my lifetime and that's from light usage. Though getting full sized sim cards is becoming harder these days I have noticed - even the precut multi sim that you push out the sim for the size and the aspect that the last phone I saw that would take a full sized (credit card sized) sim form factor was two decades ago.
- jfim 7y ago
  The ISO/IEC 7816 interfaces can pretty sturdy (eg. for ATMs), but for phones, I'd wager that most phones don't ever change the SIM card more than once or twice; phone manufacturers probably cut costs there.
exikyut 7y ago
Speaking solely from a position of outside naive curiosity, how does SIM card applet development work, why/where is custom development needed, and what sort of security considerations (are|need to be) taken into account? For example, I can settle doctor's appointments etc with what looks like a perfectly ordinary card terminal; I swipe my healthcare card and after a long sequence of button-presses by the (very patient) receptionist I get a receipt with the Medicare logo etc on it (this is in Australia). I've always wondered if all the logic to do this is hiding in the SIM card or if the card terminal is also running specialized firmware. The only bit of related anecdata I can remember was... wait, I don't believe it but I found it, probably one of the more interesting bits of applet development out there: https://news.ycombinator.com/item?id=18140208 https://news.ycombinator.com/item?id=18140208 (the entire thread is a bit of a rabbithole too: https://news.ycombinator.com/item?id=18138328 https://news.ycombinator.com/item?id=18138328)
- jfim 7y ago
  You can think of SIM cards (and other chip cards, like bank cards) as a low power computer; they run their own embedded OS and can install applets. The applets basically run on a tiny restricted JVM (no GC!) that follows the JavaCard profile. SIM card applications can talk with the handset through messages, asking the handset to display menus, send SMS messages, open a browser, and more [0]. The handset also forwards certain messages to the SIM card, such as certain special SMS messages. The SIM card can actually be reprogrammed over the air (slowly) using signed SMS messages. The applications that run on the SIM card can include certain banking applications (those were popular in countries with less robust banking infrastructure and wide deployments of feature phones) or multi-carrier SIMs. With regards to your card, if it gets swiped, it probably doesn't use a chip. For the chip to work, it has to be powered, which entails either being physically inserted in a slot or being powered through induction. I should probably write a blog post about all of this stuff, it's pretty interesting. Thanks for reminding me of it! [0] https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08.17.00_60/ts_101267v081700p.pdf https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08...
  - exikyut 7y ago
    I would definitely be very interested in a generalized inside view of how everything works! I stumbled on some PCMCIA-slot card readers at one point, which led me on a fun adventure discovering that I can list recent transactions out of my bank card. (Then after losing my wallet (annoying but not tragic) I discovered (to my initial confusion) that the latest model doesn't include this nice "feature". Hmph.) Learning how bankcards worked was very interesting. And - facepalm - of course the terminals I referred to are running their own firmware: Medicare cards do indeed use magnetic stripes. I'm currently headscratching over how authentication/access cards work, and the associated various industry thrashings (standardization, PGP crypto, cloneability, etc).

by jfim 7y ago

Zenst 7y ago

Yes, the aspect that you need to test things on many mobile networks does become easier when you can easily switch the SIM - that alone makes it kinda essential - unless you have multiple devices for each network and there are a lot - more so if you factor in roaming. That and nobody ever advertises how many times you can swap a sim and the socket pins won't break. Kinda makes you wonder how many times you can swap a sim before the socket suffers failure of some form, from wear and tear. I've certainly had a fair few break over my lifetime and that's from light usage. Though getting full sized sim cards is becoming harder these days I have noticed - even the precut multi sim that you push out the sim for the size and the aspect that the last phone I saw that would take a full sized (credit card sized) sim form factor was two decades ago.

jfim 7y ago
The ISO/IEC 7816 interfaces can pretty sturdy (eg. for ATMs), but for phones, I'd wager that most phones don't ever change the SIM card more than once or twice; phone manufacturers probably cut costs there.

exikyut 7y ago

Speaking solely from a position of outside naive curiosity, how does SIM card applet development work, why/where is custom development needed, and what sort of security considerations (are|need to be) taken into account? For example, I can settle doctor's appointments etc with what looks like a perfectly ordinary card terminal; I swipe my healthcare card and after a long sequence of button-presses by the (very patient) receptionist I get a receipt with the Medicare logo etc on it (this is in Australia). I've always wondered if all the logic to do this is hiding in the SIM card or if the card terminal is also running specialized firmware. The only bit of related anecdata I can remember was... wait, I don't believe it but I found it, probably one of the more interesting bits of applet development out there: https://news.ycombinator.com/item?id=18140208 https://news.ycombinator.com/item?id=18140208 (the entire thread is a bit of a rabbithole too: https://news.ycombinator.com/item?id=18138328 https://news.ycombinator.com/item?id=18138328)

jfim 7y ago
You can think of SIM cards (and other chip cards, like bank cards) as a low power computer; they run their own embedded OS and can install applets. The applets basically run on a tiny restricted JVM (no GC!) that follows the JavaCard profile. SIM card applications can talk with the handset through messages, asking the handset to display menus, send SMS messages, open a browser, and more [0]. The handset also forwards certain messages to the SIM card, such as certain special SMS messages. The SIM card can actually be reprogrammed over the air (slowly) using signed SMS messages. The applications that run on the SIM card can include certain banking applications (those were popular in countries with less robust banking infrastructure and wide deployments of feature phones) or multi-carrier SIMs. With regards to your card, if it gets swiped, it probably doesn't use a chip. For the chip to work, it has to be powered, which entails either being physically inserted in a slot or being powered through induction. I should probably write a blog post about all of this stuff, it's pretty interesting. Thanks for reminding me of it! [0] https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08.17.00_60/ts_101267v081700p.pdf https://www.etsi.org/deliver/etsi_ts/101200_101299/101267/08...
- exikyut 7y ago
  I would definitely be very interested in a generalized inside view of how everything works! I stumbled on some PCMCIA-slot card readers at one point, which led me on a fun adventure discovering that I can list recent transactions out of my bank card. (Then after losing my wallet (annoying but not tragic) I discovered (to my initial confusion) that the latest model doesn't include this nice "feature". Hmph.) Learning how bankcards worked was very interesting. And - facepalm - of course the terminals I referred to are running their own firmware: Medicare cards do indeed use magnetic stripes. I'm currently headscratching over how authentication/access cards work, and the associated various industry thrashings (standardization, PGP crypto, cloneability, etc).