8 ms·
Privacy and Security Risks in the eSIM Ecosystem [pdf]
- globalhsbc 1y ago[dead]
- punnerud 1y ago[flagged]
- Piraty 1y agoyou could just have read the abstract instead
- jiveturkey 1y agoto save you from loading the pdf: > This paper presents an empirical investigation of how eSIM adoption affects user privacy, focusing on routing transparency, reseller access, and profile control. We first show how travel eSIMs often route user data through third-party networks, including Chinese infrastructure, regardless of user location. This raises concerns about jurisdictional exposure. Second, we analyze the implications of opaque provisioning workflows, documenting how resellers can access sensitive user data, proactively communicate with devices, and assign public IPs without user awareness. Third, we validate operational risks such as deletion failures and profile lock-in using a private LTE testbed.
- thijsr 1y agoScientific papers have an abstract, which already serves as a short summary.
- punnerud 1y agoHave you read the abstract? Most of them is a teaser, and does not contain any information from the conclusion etc. So a summary is still valid?
- pjmlp 1y agoI will keep using SIM as long as it is possible, not only is eSIM a way for operators to impose restrictions on unlocked pre-paid phones, some really like to take their cut every time that eSIM gets moved, for something free of charge and doable under a few seconds with a regular SIM.
- leakycap 1y ago> not only is eSIM a way for operators to impose restrictions on unlocked pre-paid phones Are you outside the US? I've used eSIM on iOS many times with a number of carriers and MVNOs and never noticed a fee (unless you're talking about a postpaid carrier's line activation fee, usually around $36, not related to esim or not)
- nottorp 1y agoIt's not only the fee. eSIM simply needs too many entities to cooperate just so you don't have to look for a paper clip.
- testdelacc1 1y agoAn eSIM only phone could have a bigger battery, if the manufacturer replaces the sim tray with a larger battery. That’s what Apple has done in the iPhone 17 series released last week. The US versions are eSIM only, and have better battery life. That’s a trade a lot of people would gladly make.
- antonyh 1y agoThe iPhone 17 in the UK still has the SIM tray, something I'm glad about. Knowing I can pull the SIM and slot it into my old iPhone 8 where there is no eSim support is valuable to me.
- nottorp 1y agoAnd how about knowing that it takes a minute to swap a physical sim and there is no server to take its sweet time and at worst not respond like for eSIM? Say you arrive somewhere where your regular provider doesn't have signal so you get a prepaid sim from the one provider that does have signal. How do you install it if it's an eSIM? You don't have connectivity on your regular.
- lazycatjumping 1y agoThanks to Wireguard and basically 0% battery overhead on Android I always keep it activated. If you don't have a Wireguard endpoint just use Orbot to route it through Tor. Did that several times using cheap eSIMs while traveling. Never had a single problem with it (but increased latency because of weird routings around the world).
- 8fingerlouie 1y agoWireguard is amazing. I have an "always on" VPN routing back home. Anything destined for my home network gets routed that way, and there's literally zero battery drain. I'm not paranoid enough to route everything through VPN though.
- lazycatjumping 1y agoFor me it's not paranoia.. more like: I have a ton of unused GBit/s left.. so routing a few kBit... MBit/s of mobile data doesn't hurt.
- 8fingerlouie 1y agoWhat I meant was, I don't subscribe to a public VPN service, so routing all my traffic through my wireguard tunnel back home would merely mean it went through a different ISP. I already use SDNS with Nextguard, and all traffic is https encrypted, and my day to day business on the internet is probably rather boring to the majority of people. Not saying I have nothing to hide, everybody does, but my visits to various news outlets, social media and other sites is probably not all that interesting. The most interesting data about you comes from your phones constant reporting of cell towers, which can be used to triangulate you, and put a timestamp on where you were, when.
- hippich 1y agoRecently I was looking for solution to have multiple VPN running at the same time, and without work profile I am limited to one. I want to run two (or more) and be able to tell which app uses no VPN, which routes through vpn1, which routes through vpn1, etc. so far it looks like I need multiple profiles, and that requires root, which Google actively discourages. Maybe someone knows better alternatives?
- flowerthoughts 1y ago> We first show how travel eSIMs often route user data through third-party networks [---] Second, we analyze the implications of opaque provisioning workflows, documenting how resellers can access sensitive user data [---]. Third, we validate operational risks such as deletion failures and profile lock-in using a private LTE testbed. So not about eSIM the technology, but the business landscape inviting opportunistic business people when the bar of entry is lowered. Table 1 is worth a read. The outrage bait about traffic being routed through China shouldn't matter too much to the common person, since we're mostly using TLS. If you're on DoH (DNS over HTTPS), you're even using it for host lookups.
- itake 1y ago1/ ISP or the website Youre accessing can see the DNS queries and block traffic. My eSIM routes through Hong Kong, which means no ChatGPT. 2/ iPhones don't get you set the DNS provider / DoH for cellular 3/ DoH breaks wifi redirect walls, making it tedious to enable/disable. Like you cant just enable DoH for certain apps or disable it for others.
- IshKebab 1y ago> DoH breaks wifi redirect walls Is that really true? I would have thought all the automatic detection features try with unencrypted DNS? They should anyway.
- astafrig 1y agoIdeally it’d actually be RFC 8910 detection (and subsequently RFC 8908 API) but standards usage is generally incompatible with giving POs something to do
- Gigachad 1y agoJust get a VPN and then you can route your traffic wherever you want and not have to worry about what the carrier is doing.
- 1y ago
- daft_pink 1y agoThe fact that Chinese domestic cell users can only use phones sold in China on eSim, and as soon as they leave China the eSims no longer work, gives me pause that there is some nascent security hole in them. Why would they take such extreme measures if there wasn’t some issue with the security?
- notpushkin 1y agoTo prevent them from using Hong Kong eSIMs to bypass site blocks?
- thenthenthen 1y agoIt is interesting, my EU iPhone can use Chinese eSims unrestricted in Mainland (via trip.com), advertised as HK/Macao/Mainland travel eSims. As other have said, iPhones for the Chinese market can not. So the phone smuggling is still big business. Also, there is a quota on the amount of sims given out each month, but dont er quote me on that (at least that was the case with physical HK/Mainland sims sold in HK Shamshuipo etc).
- okanat 1y agoIt could be simply IMEI tracking. Turkey also has it. Without being registered in the country registry, the modem just stops getting answers from cell towers.
- uni_baconcat 1y agoIncorrect. Chinese mobile carriers only issue eSIM to their approved models, which are devices sold in China. Once the eSIM is activated, users can roaming with their Chinese phone number to any country just like a physical SIM card. Also, iPhone and iPad sold in China can install and activate an eSIM from foreign carriers when the device is not located in China. They only banned activating foreign eSIM within China.
- kube-system 1y ago> They only banned activating foreign eSIM within China. Is that even a ban? I didn’t think eSIM activation typically roams — I thought it only worked on home networks.
- futurecat 1y agoUsed an eSim on a trip to Japan recently. I wasn't happy when I realized my IP was in Hong-Kong.
- lazycatjumping 1y agoJust switch on a VPN. No reason to avoid cheap providers.
- neilalexander 1y agoRouting through another country unexpectedly already makes your latency worse. Adding a VPN on top possibly worsens it again.
- dboreham 1y agoWhich goes through HK and somewhere else..
- vachina 1y agoThe telco is probably from Hong Kong, and using home-routed roaming, that is subscribers access the visited network through the home PDN gateway (H-PGW). When I roam with mine my IP is always from my home country. There is nothing insidious happening.
- rahimnathwani 1y agoThere are companies in Japan that provide esim connections that don't route via an overseas provider, e.g. https://www.sakuramobile.jp/japan-sim-card/local-japan-esim-vs-international-a-travelers-guide/ https://www.sakuramobile.jp/japan-sim-card/local-japan-esim-... EDIT: Last time I went to Japan, I bought an esim from https://jjesim.com/esim https://jjesim.com/esim
- futurecat 1y agothank you!
- 2rsf 1y agoI read some of the article and stil not sure what is so unique about eSIM compared to physical SIMs. Is routing user traffic through third-party infrastructure unique to eSIM? The other risks mentioned are mostly rare edge cases
- tgsovlerkhgsel 1y agoRemoving the need to ship a physical SIM card created an entirely new ecosystem. There is very little difference between a physical SIM from provider X and an eSIM from provider X (except that one requires an available physical slot and the other is a pain to move between devices), but eSIM allowed many new provider and reseller business models. In practice, this means much more choice, much lower prices, but often also lower quality because everything is optimized to be as cheap as possible and often involves roaming agreements where your traffic gets sent on high-latency world tours.
- elAhmo 1y agoThis is a weird title and IMO should have included "international resellers" to emphasise the risks are sourced from there, not really due to the eSIMs themselves. Those online-only, travel-oriented resellers, are incorporated or using providers from unregulated or less regulated markets. If you use an eSIM provided by your own domestic carrier, which I do and many of my friends, especially when having more than one phone number, almost none of the risks in the paper are applicable.
- negative_zero 1y agoCalling it "eSIM" is BS marketing. Every time I've used them it's been painful. I don't know the details but it absolutely is not "SIM technology". "eSIM" is something completely different. A regular SIM: you just pop a SIM card into your phone and it just God damn works. But eSIMs? I've used eSIMs from five carriers in three different countries and every time there is some issue: * "Oh you need our god awful app to install an eSIM" (of course I couldn't easily download it because Google play geo hides apps). * "If your phone is stolen overseas you can simply use this QR barcode again to register an eSIM to a new phone" (I couldn't). * "Works with all phones". (It didn't because phone manufacturers have to bake Telco specific data into your phones firmware. Not supported? You're shit out of luck). I could go on.. The fact that there are now privacy and security issues is not surprisingly at all. This isn't teetching issues. The drafters of the eSIM standard should be publicly flogged.
- Y_Y 1y agoIt's an emulated sim card, it really does emulate that weird little Java processor and everything. It's totally "SIM technology" in that sense, even if it's not conventient because of the restrictions of the emulation device.
- negative_zero 1y agoI did not know that. It's amazing how the usability and utility has taken such a big hit.
- ufmace 1y agoWell, a regular SIM mostly just works, except for when it doesn't. I haven't had any APN issues with regular SIMs in a while actually, but it used to be a common problem that would only sometimes auto-configure correctly. I've definitely had to google carrier APN settings and fiddle with them for a while to get text, MMS, and internet access working properly. I also recently had an issue where I moved my US MVNO provider SIM to a new phone and it mostly worked, except for RCS. When I called them, they claimed my phone model wasn't compatible with their network, despite me already using it on their network for months. Apparently in their opinion SIMs should never actually be moved to a different phone. They offered to sell me a new phone, but I switched to a new carrier instead.
- mrb 1y agoThey used cool hardware to do this research: the sysmoEUICC1 (https://shop.sysmocom.de/sysmoEUICC1-eUICC-for-consumer-eSIM-RSP/sysmoEUICC1-C2G https://shop.sysmocom.de/sysmoEUICC1-eUICC-for-consumer-eSIM...) which is a physical SIM card onto which one can load an eSIM, and they put it in a SIMtrace 2 device (https://osmocom.org/projects/simtrace2/wiki https://osmocom.org/projects/simtrace2/wiki) to trace the data packets to/from the eSIM profile, which is normally not easily doable as modern phones load the eSIM on a chip soldered onto the phone's motherboard. So you end up with a goofy contraption (see figure 4 on page 8) but you have full visibility into the communications to/from the eSIM profile. Fun!
- Derbasti 1y agoLast vacation, one of our phones broke. We bought a new one, popped in the old SIM, and went on vacationing. How does that work with an eSIM?
- jiqiren 1y agoInstall phone company app, login, and click migrate eSIM to this phone. Whole process can take up to 5min depending on how fast wifi is to connect to your phone company.
- rsync 1y ago"Install phone company app ..." You've already lost me there. I don't install the samsung dishwasher app or the mcdonalds value points app or the Mountain Dew summer of fun app ... why would I install some random national carrier telco app ?
- JumpCrisscross 1y ago> How does that work with an eSIM? Same, except you download it.
- mbirth 1y agoHa, you say that. When my wife’s German T-Mobile eSIM vanished during transfer to a new phone, their portal for downloading a new one required a token sent to that very phone number we just lost access to. This meant we had to do a trip to their store where they said that there’s no process for the store to supply us with an eSIM, but they’ll setup a new traditional SIM which we could then convert to eSIM. Ridiculous! At least it was all free - apart from the time spent. That was a few years ago, though. So, I very much hope they’ve improved on the process.
- JumpCrisscross 1y agoIf we're going on anecdotes, I've had a number of times when a physical SIM popped into a smartphone started behaving bewilderingly.
- asah 1y agoIf you want no/less bs, I recommend Google Fi eSim
- UltraSane 1y agoBut then if Google's incomprehensible security algorithm locks your account you don't have a phone anymore and zero recourse.
- unixhero 1y agoIn this aspect, what does people on here think about the eSim provider Saily[0][1]? [0] Website, https://saily.com/ https://saily.com/ [1] Actual operator is 1GLOBAL alias TP Global * Provision of Services The Services to Customer will be provided by our Technology Partner - TP Global Operations Limited, a limited liability company incorporated and registered in England and Wales with company number 14109189 whose registered office is at 109 Farringdon Road, Farringdon, London, EC1R 3BW, UK (“1GLOBAL”). * https://saily.com/legal/b2b-terms-of-service/ https://saily.com/legal/b2b-terms-of-service/
- Y_Y 1y agoThey have a lot of obnoxious advertising which makes me not trust them. I've used Airalo without much hassle, but I can't say that they're any better. I did have an incident where the phone I was using broke, and I was unpleasantly surprised to find that I couldn't just load the eSIM onto the replacement phone, seems like you only get one shot at downloading it. (Dragonpass is pretty good though, I recommend getting that through a credit card or whatever if you spend a lot of time habging around airports.)
- unixhero 1y agoI had to edit and take out my reasoning for asking (I said why I liked it), as it seemed like I was shilling the service, which I wasn't intending to do. Thank you for the insights!
- philipwhiuk 1y ago1 GLOBAL is owned by 1GLOBAL Holdings B.V. Registered address: The Valley - Beethovenstraat 505 North tower, Level 6. Amsterdam 1083HK, Netherlands So we're at 3 levels of indirection on ownership already. In practice, 1 Global is the trading name of TP Global because it's the successor company to 'Truphone': > In 2022 the Company was selected in a competitive bidding process, conducted by a UK court appointed administrator of Truphone Limited (“Truphone”), to acquire all the business and assets of Truphone (the “Acquisition”). And this company was an investment option for Russian oligarchs: > In December 2024, German Manager Magazin revealed that Russian oligarchs Abramovich, Abramov and Frolov, who had previously owned 96% of Truphone and invested more than €360 million in the company, could still benefit from any success achieved by 1Global. So yeah, maybe avoid.
- riobard 1y agoThe paper is somewhat title-bait: most of the data flow and privacy concerns (section 3) isn't caused by eSIM but by MVNO and business practices which applies to physical SIM as well. Additionally, it's expecting too much from _travel_ SIM cards (physical or embedded) where the primary consumer concern is cost.
- unit149 1y ago[dead]
- patrakov 1y ago> This has fueled a global marketplace of online eSIM resellers [54], operating across borders with minimal regulatory oversight. These services are typically marketed through web stores and mobile apps, with providers operating across borders and often facing minimal regulatory oversight. But this is exactly the situation we have with VPNs. VPNs have proven themselves to be a useful tool for censorship circumvention, and foreign eSIMs are thus an interesting alternative suitable for this purpose, especially if traditional VPNs are blocked by the state.