Hacker News Reader

Comment by foolfoolz | Hacker News Reader

the sim is no piece of plastic. SIM cards are computers! they have a CPU. they have memory, a file system. they run applets, yes Java applets. sims are one of the most secure pieces of technology out there, part of the Secure Element standard. the sim is responsible for a lot of your phones security. lots of encryption keys live on the sim and nothing can access them at all. I am much much happier to trust the hardware than software for some of this. smaller form factors are always coming out for sim, but it's worth the space

View on HN

>I am much much happier to trust the hardware than software for some of this

Most SIMs I know are black boxes, with 0 public documentation. Taking into account that they are issued by telecom companies I don't trust them at all.

the reason there are multiple sim manufacturers and SIM cards interop seamlessly into any device is because they are built entirely on published standards. there is tons documentation, usually in the form of giant specifications. look for Secure Element. Java card. global platform. UICC.

The standard is out there if you're willing to pay ETSI (or whomever - though the CDMA2000 specs are open and online) the money to get at it. They're not black boxes by any measure of the word.

On a dumb phone yes contacts are stored on your SIM maybe using some kind of weak crypto, yes. On an iPhone X, it’s completely unused for crypto or security, or for any other purpose other than carrier authentication.

carrier authentication is huge! do you want someone to be able to subscribe to a network with your phone number? receive your calls? texts? or call or text as if they are you? yes the sim has little relevance to device security for most smartphones. contacts on sim are a great example of supporting legacy features for BC only. but the network is still very important to secure.

sims are used for more than just phones. the chip on your credit card is a Secure Element. the chip in your passport is too. these are some of the most physically and technically secure pieces of hardware ever made

Carrier authentication is not huge. The vast majority of communications services today are secure without a SIM, even ones that are tied to your number. Ever notice that iMessage keeps working without a SIM? The SIM card is mostly a relic that is useful to the carrier oligopoly because it increases network switching friction.

If someone is able to authenticate as your phone number, they can set up iMessage and receive a copy of your future messages.

Wouldn't they need to at least need to log in with your iCloud credentials?

nope iMessage does not require iCloud

This is wrong. iMessage uses your Apple ID and is definitely iCloud based. That's how it can tell the state of messages from device to device.

you wouldn't be able to authenticate on the data network without a sim. unless you exclusively use wifi the carrier network is still a huge part of everyone daily phone use

The onboard crypto is still used to secure voice calls.

Why not use the same secure element as Apple is using for Apple Pay for this?

Because the SIM is universal, its designed to be architecture independent, the SIM is also open, when the secure element that apple is using for apple pay is not.

Reply on news.ycombinator.com