6 ms·

I share your concerns but at the same time I think, why would we even need a SIM? Isn't it simply a device for accessing account on someones system? We don't h

by mrtksn 5y ago

I share your concerns but at the same time I think, why would we even need a SIM? Isn't it simply a device for accessing account on someones system? We don't have SIMs for ADSL or Fiber internet? We don't have SIMs for Reddit ot Twitter? Why would we have SIMs accessing GSM networks? There's no fundamental reason why we simply don't sign in into these networks like signing in to HN. Surely, it adds a layer of anonymity and freedom where you simply use the system by paying it however there's an ongoing trend all over the world of de-anonymisation. In many places they are asking for ID and other documents in order to provide you with a SIM. Physical SIM now means, it's yet another obsolete tech that costs money and takes space inside the devices only to sustain anonymity that is no longer desired. SIM is just another causality on the way towards the tightly controlled world. IMHO, it needs to happen at some point but we also need to rethink our rights in a world that is run by these huge networks. Wouldn't be nice if our phones could have simply scanned for the networks, receive the offers from the available networks, pay and start using it?

deleted 5y ago
[deleted]
junon 5y ago
Because SIMs require the physical card. You cannot forge a SIM without the SIM itself. There's a physical second factor. Usernames and passwords get leaked all the time, and since Reddit et al are meant to be accessed by multiple devices, device-locking them would be antithetical and anti-consumer. A phone service is implicitly device-locked (well, doesn't have to be, but it doesn't make sense to allow multiple devices per number anyway). Just using device credentials could allow anyone to log in with that information and use your subscription or pose as you. As for ADSL or other forms of internet, there is already a second factor - ISPs generally know from which vicinity you are connecting from, and when you log in with your account information in your modem, they can match what's on your account to your physical "drop" and assert that it is at least within the same neighborhood - again, creating a physical second factor. This is also why your internet service generally needs to be "moved" whenever you change your residence. A SIM card allows the freedom as the GP mentioned, without requiring someone from the centralized authority to process the request somehow. There is a huge difference if you think about it for a bit.
- jtbayly 5y ago
  I think you are confused. SIM cards are not a second factor. SIM swaps are proof of this.
  - Nextgrid 5y ago
    SIM is the second factor when it comes to proving that this device with this physical SIM is indeed accessing the network. Fraudulent SIM swaps are attacking a different layer of the system, they are social-engineering underpaid idiots to associate a new SIM with a given account & number. You could in theory social-engineer a bank to reissue someone's payment card and somehow intercept it in the post or steal it from their mailbox. That doesn't mean chip & PIN is insecure.
    - deleted 5y ago
      [deleted]
    - jtbayly 5y ago
      But Esim already exists. Nobody needs to steal your SIM card to start using your phone number.
    - ksec 5y ago
      And from my understanding, these social engineering and sim swap problems are mostly ( if not all ) US specific. I have never heard anything near the order of magnitude of US sim swap from any other country. Most countries have Personal ID that are required and issued by government as verification. But even places like UK will require address and Driving License / Passport proof along with security questions.
      - Nextgrid 5y ago
        > But even places like UK will require address and Driving License / Passport proof along with security questions. I was a phone store monkey in the UK a few years back and a dedicated attacker can absolutely bypass this: https://news.ycombinator.com/item?id=29714400 https://news.ycombinator.com/item?id=29714400 I can only assume it's not more common because other scams are more profitable and/or not enough targets (banks, etc) use SMS 2FA as their only method of authentication so a SIM swap wouldn't give you much.
throw0101a 5y ago
> I share your concerns but at the same time I think, why would we even need a SIM? In the Before Times: handy for travel. Having a (e)SIM for your personal number (but perhaps disable data), and when you arrive at your destination just pop in a new physical SIM for local data (and calling). > We don't have SIMs for ADSL or Fiber internet? I wish we did. At least for ADSL you can use PPPoE to login into a network with whatever hardware you wish to use instead of the telco's often janky, underpowered stuff. With fibre (GPON) they often lock in the MAC of the optic, so good luck using something else besides whatever is provided. If you're lucky you can remove the SFP module and put it into whatever you want. This may not be useful for 99% of the population, but given this is HN we're on, I think a lot of folks can appreciate being 'hardware agnostic'. Otherwise we're back to the 1960s when only Officially Approved™ equipment can be connected: * https://www.cybertelecom.org/notes/att_antitrust.htm https://www.cybertelecom.org/notes/att_antitrust.htm
- fomine3 5y ago
  AFAIK PON based system needs encryption/decryption by ONU because it separates single fiber passively so downlink can be tapped. Encryption key is burned to each ONU.
  - throw0101a 5y ago
    (All? Most? Many?) ONTs support 802.1X for authenticating network access, which supports EAP. And EAP-SIM is one available mechanism, though usually used on the wireless side of networking. In Canada, Bell had their "Home Hub 3000" and plenty of folks took out the optic and put it in their own hardware; this possibility was 'discontinued' with the Home Hub 4000, which no longer has a removable optic. There is nothing inherent on the ONT that limits connectivity except the arbitrary telco design choices.
saltminer 5y ago
> We don't have SIMs for ADSL or Fiber internet? Fiber is actually quite complex. Most residential fiber going in today is GPON, and those systems are authenticated by the ONT, which is somewhat analogous to a hardwired SIM. Theoretically, you could reverse engineer the ONT and create your own, but you can expect to get your account closed if they catch you. Then you have companies like AT&T who also force you to use their godawful routers and actively work to close off methods that allow using your own router. And if you have metro-E, chances are the ISP provides their own media converter. Doesn't matter that they charge a $12k install fee and $1200/mo (for 500/500 - actual Comcast bill in Nashville, TN), they still won't hand you an SFP+ module.
takeda 5y ago
> We don't have SIMs for ADSL or Fiber internet? The reason for it is because they are physically provided to your house so it would be redundant, but if that wasn't a case, imagine if we did have SIM for ADSL or Fiber. Getting access to your Internet service wherever you go without extra charges. > We don't have SIMs for Reddit ot Twitter? > Why would we have SIMs accessing GSM networks? There's no fundamental reason why we simply don't sign in into these networks like signing in to HN. We have login and password, which are like SIM, but you can memorize them. Imagine if your access to Reddit, Twitter, HN was tied to your computer, because that's essentially what you're advocating for.
- Gigachad 5y ago
  > Imagine if your access to Reddit, Twitter, HN was tied to your computer, because that's essentially what you're advocating for. You have missed the point. OP is talking about how ridiculous having a physical bit of plastic to log in to the cell towers is. The physical sim provides next to no value. And it comes at a heavy cost in space inside the phone as well as annoyance waiting for a new sim to ship in the mail. While esim providers email you a QR code and you are good to go immediately.

by mrtksn 5y ago

deleted 5y ago

[deleted]

junon 5y ago

Because SIMs require the physical card. You cannot forge a SIM without the SIM itself. There's a physical second factor. Usernames and passwords get leaked all the time, and since Reddit et al are meant to be accessed by multiple devices, device-locking them would be antithetical and anti-consumer. A phone service is implicitly device-locked (well, doesn't have to be, but it doesn't make sense to allow multiple devices per number anyway). Just using device credentials could allow anyone to log in with that information and use your subscription or pose as you. As for ADSL or other forms of internet, there is already a second factor - ISPs generally know from which vicinity you are connecting from, and when you log in with your account information in your modem, they can match what's on your account to your physical "drop" and assert that it is at least within the same neighborhood - again, creating a physical second factor. This is also why your internet service generally needs to be "moved" whenever you change your residence. A SIM card allows the freedom as the GP mentioned, without requiring someone from the centralized authority to process the request somehow. There is a huge difference if you think about it for a bit.

jtbayly 5y ago
I think you are confused. SIM cards are not a second factor. SIM swaps are proof of this.
- Nextgrid 5y ago
  SIM is the second factor when it comes to proving that this device with this physical SIM is indeed accessing the network. Fraudulent SIM swaps are attacking a different layer of the system, they are social-engineering underpaid idiots to associate a new SIM with a given account & number. You could in theory social-engineer a bank to reissue someone's payment card and somehow intercept it in the post or steal it from their mailbox. That doesn't mean chip & PIN is insecure.
  - deleted 5y ago
    [deleted]
  - jtbayly 5y ago
    But Esim already exists. Nobody needs to steal your SIM card to start using your phone number.
  - ksec 5y ago
    And from my understanding, these social engineering and sim swap problems are mostly ( if not all ) US specific. I have never heard anything near the order of magnitude of US sim swap from any other country. Most countries have Personal ID that are required and issued by government as verification. But even places like UK will require address and Driving License / Passport proof along with security questions.
    - Nextgrid 5y ago
      > But even places like UK will require address and Driving License / Passport proof along with security questions. I was a phone store monkey in the UK a few years back and a dedicated attacker can absolutely bypass this: https://news.ycombinator.com/item?id=29714400 https://news.ycombinator.com/item?id=29714400 I can only assume it's not more common because other scams are more profitable and/or not enough targets (banks, etc) use SMS 2FA as their only method of authentication so a SIM swap wouldn't give you much.

throw0101a 5y ago

> I share your concerns but at the same time I think, why would we even need a SIM? In the Before Times: handy for travel. Having a (e)SIM for your personal number (but perhaps disable data), and when you arrive at your destination just pop in a new physical SIM for local data (and calling). > We don't have SIMs for ADSL or Fiber internet? I wish we did. At least for ADSL you can use PPPoE to login into a network with whatever hardware you wish to use instead of the telco's often janky, underpowered stuff. With fibre (GPON) they often lock in the MAC of the optic, so good luck using something else besides whatever is provided. If you're lucky you can remove the SFP module and put it into whatever you want. This may not be useful for 99% of the population, but given this is HN we're on, I think a lot of folks can appreciate being 'hardware agnostic'. Otherwise we're back to the 1960s when only Officially Approved™ equipment can be connected: * https://www.cybertelecom.org/notes/att_antitrust.htm https://www.cybertelecom.org/notes/att_antitrust.htm

fomine3 5y ago
AFAIK PON based system needs encryption/decryption by ONU because it separates single fiber passively so downlink can be tapped. Encryption key is burned to each ONU.
- throw0101a 5y ago
  (All? Most? Many?) ONTs support 802.1X for authenticating network access, which supports EAP. And EAP-SIM is one available mechanism, though usually used on the wireless side of networking. In Canada, Bell had their "Home Hub 3000" and plenty of folks took out the optic and put it in their own hardware; this possibility was 'discontinued' with the Home Hub 4000, which no longer has a removable optic. There is nothing inherent on the ONT that limits connectivity except the arbitrary telco design choices.

saltminer 5y ago

> We don't have SIMs for ADSL or Fiber internet? Fiber is actually quite complex. Most residential fiber going in today is GPON, and those systems are authenticated by the ONT, which is somewhat analogous to a hardwired SIM. Theoretically, you could reverse engineer the ONT and create your own, but you can expect to get your account closed if they catch you. Then you have companies like AT&T who also force you to use their godawful routers and actively work to close off methods that allow using your own router. And if you have metro-E, chances are the ISP provides their own media converter. Doesn't matter that they charge a $12k install fee and $1200/mo (for 500/500 - actual Comcast bill in Nashville, TN), they still won't hand you an SFP+ module.

takeda 5y ago

> We don't have SIMs for ADSL or Fiber internet? The reason for it is because they are physically provided to your house so it would be redundant, but if that wasn't a case, imagine if we did have SIM for ADSL or Fiber. Getting access to your Internet service wherever you go without extra charges. > We don't have SIMs for Reddit ot Twitter? > Why would we have SIMs accessing GSM networks? There's no fundamental reason why we simply don't sign in into these networks like signing in to HN. We have login and password, which are like SIM, but you can memorize them. Imagine if your access to Reddit, Twitter, HN was tied to your computer, because that's essentially what you're advocating for.

Gigachad 5y ago
> Imagine if your access to Reddit, Twitter, HN was tied to your computer, because that's essentially what you're advocating for. You have missed the point. OP is talking about how ridiculous having a physical bit of plastic to log in to the cell towers is. The physical sim provides next to no value. And it comes at a heavy cost in space inside the phone as well as annoyance waiting for a new sim to ship in the mail. While esim providers email you a QR code and you are good to go immediately.